Protect donor and participant information as staff and volunteers change
Secure staff and volunteer accounts, protect sensitive records, and maintain clear reporting for your board and funders.
A 30-minute conversation about your setup, priorities, and next step. Technical checks and written findings are scoped separately.
Send a message or email hello@teclara.tech
Security risks
Plan for volunteer changes, fundraising, and reporting.
Volunteer turnover, fundraising campaigns, and reporting deadlines create different security needs. Clear access procedures and email protection help staff manage those demands.
Onboarding
Volunteers and short-term staff arrive
Give each volunteer or temporary staff member an individual account with access limited to their role. Review permissions when responsibilities change and remove access when the role ends.
November and December
Year-end giving
During fundraising campaigns, staff handle donation receipts and payment requests. Training helps them recognize fraudulent gift-card or payment requests that impersonate leadership.
Grant reporting
A funder asks how data is handled
Funders or partners may set requirements for how program and participant data is handled. Current access and backup records help document how that information is protected.
Board meeting
The board asks about risk
Directors need clear information about cyber risk to make spending and oversight decisions. A quarterly review explains outstanding risks, agreed actions, and who is responsible for addressing them.
Security controls
Security should match the information in your care
Not every nonprofit holds the same data or faces the same consequences. We agree which accounts, devices, data, and recovery needs the service will cover.
Identity
Protect staff and volunteer accounts
Multi-factor authentication, administrator controls, and sign-in monitoring help prevent unauthorized access using stolen credentials. Named accounts make access easier to review and remove when a role ends.
Email
Reduce phishing and impersonation
Email controls filter common account-takeover, fake-invoice, and impersonation attempts. The security team investigates suspicious activity under the agreed response process.
Devices
Protect your work devices
Managed endpoint protection, encryption, and security updates apply to supported staff devices covered by the service.
Sharing
Review access to sensitive folders
Shared drives, SharePoint sites, guest access, and external links are reviewed against the access needs of each team and program. Access is removed when a staff or volunteer role ends.
Recovery
Maintain independent cloud backups
Microsoft 365 or Google Workspace data is backed up outside the tenant and tested for recovery.
People
Train staff and volunteers to recognize phishing
Short training sessions and phishing simulations help staff and volunteers recognize suspicious messages. Awareness training is included for nonprofits without a separate training fee.
Security documentation
Provide clear security reporting to boards and funders.
We maintain records of the controls we operate so your team can respond to board, funder, and insurance questions.
- Board of directors
- What are our biggest risks, and what is being done about them?
- A quarterly review with gaps, actions, owners, and status, written for directors.
- Funders and partners
- How is participant or program data protected, and who can access it?
- Program-folder permissions, reports showing MFA coverage, and details of the Microsoft 365 or Google Workspace data included in backups.
- Cyber insurer, at renewal
- Is MFA enforced? Are backups tested? Do staff get phishing training?
- Coverage reports, the date of the last restore test, and training and simulation records, which are included for nonprofits.
Your responsibilities
The organization remains responsible for privacy, safeguarding, funder, contractual, and records decisions. Teclara operates and documents the security controls we manage. Donor, case-management, fundraising, grant, program, and partner systems are included only when specified in the service agreement, and personal or partner devices are covered only when enrolled.
Managed Security & Compliance
Ongoing security for your accounts, devices, and data.
The security controls on this page run on the platform you use, with access controls, reporting, and maintenance schedules adapted to your organization.
On Microsoft 365
- MFA and administrator controls for staff accounts
- SharePoint and OneDrive access reviewed by program
- Managed endpoint protection on supported devices
- Staff and volunteer access removed through offboarding
On Google Workspace
- MFA and administrator controls for staff accounts
- Shared-drive and external-sharing access reviewed
- Gmail phishing and impersonation protection
- Staff and volunteer access removed through offboarding
Configuration updates are part of the service. When we upgrade the tools and monitoring in your agreement, you get the upgrade at no added cost.
Frequently asked questions.
Can you support a smaller nonprofit?
Scope and pricing follow the supported users, devices, and systems covered by the service. We assess your security needs and document which systems and services are included. Awareness training is included for nonprofits without a separate training fee. For a budget discussion, bring staff and volunteer account counts, seasonal changes, your Google or Microsoft licence edition, and the donor or program systems you use. Ask us to confirm how those accounts and any required licence upgrades affect the quote.
Which nonprofit information can be covered?
Managed Security & Compliance can protect accounts, email, files, sharing, and supported devices in Microsoft 365 or Google Workspace. Donor, case-management, fundraising, grant, program, and partner systems need a separate assessment because they may sit outside the cloud tenant.
Can you secure a nonprofit that runs entirely on Google Workspace?
Yes. Work can include administrator and sign-in controls, Gmail protection, shared-drive permissions, external sharing review, supported devices, independent backup, monitoring, and staff or volunteer offboarding. Available controls depend on Workspace licensing and the systems we manage.
Are remote staff and volunteers covered?
Account security policies can remain in effect when people work remotely. Managed endpoint protection applies only to supported devices that are enrolled, while personal or partner devices remain outside endpoint coverage. The organization decides which roles and devices must meet each access rule.
What evidence can boards or funders receive?
Reporting can include sign-in and access records, backup and restore evidence, patching and vulnerability status, alert response records, and written control descriptions. The organization remains responsible for its reporting to boards, funders, and auditors, and for its privacy and safeguarding decisions.
What is included, and what requires Managed IT?
Managed Security & Compliance covers the agreed security controls, monitoring, endpoint protection, cloud backup, patching, awareness training, and tenant security configuration. General helpdesk, device procurement, routine user support, and full day-to-day technology administration are included only with Managed IT, which includes Managed Security & Compliance.
Client feedback
What a client says about working with us.
“Wadhah at Teclara is amazing.”
M.C.
Chief Executive Officer, Education Non-Profit
Led by Wadhah Hussain, Teclara's founder
Enterprise Architect · 20+ years in enterprise IT, including Big Four consulting
Where we work
Based in Oakville. We work remotely with firms across Canada.
Each area page explains how delivery works there. We don't keep offices outside Oakville, so where you're located doesn't limit what we can support.
Review access to your accounts and sensitive records
In a 30-minute conversation, we discuss staff and volunteer access, donor or program systems, and your budget. We agree on the next step. Technical checks and written findings belong to a separately scoped engagement.