Client portal A budget voted once a year
A surprise invoice in March has no line in the budget. The board wants a figure it knows ahead of time.
Nonprofits
IT for nonprofits and community organizations
In a nonprofit, every dollar spent on IT is a dollar that does not go to the mission. So things get stretched: the former coordinator’s laptop, a password the whole team knows, the president’s nephew who fixes things. It holds, until the day the donor list goes to the wrong recipient.
IT services for a nonprofit include employee support, account management at every arrival and departure, protection of donor and client information, and a verified backup. OKTO Solutions offers them to organizations in Quebec on a monthly plan or through a prepaid bank of hours.
Three constraints
What do IT services for a nonprofit cover?
IT services for a nonprofit cover the same ground as for a business, with three added constraints: a tight budget, people who arrive and leave often, and sensitive information about donors or clients. An organization with ten employees may also have forty volunteers, a board and a few interns, each with access to something. OKTO Solutions, whose office is in Trois-Rivières, offers nonprofits and community organizations in Quebec a monthly plan per workstation, or a prepaid bank of hours when the budget allows no more. The service includes workstation monitoring, employee support, account management at arrival and departure, email protection and backup. Microsoft, for its part, donates some licences and discounts others for the organizations it finds eligible. That decision is made at Microsoft, not here. Our work begins once the licences have been obtained and have to be assigned to the right people.
People who come and go
Interns, contracts tied to a grant, volunteers for one evening or for ten years, board members. Every arrival opens an access. Every departure should close one.
Delicate information
A donor list with amounts. Client files that describe someone’s health, housing or family situation.
Microsoft licences
Which Microsoft licences are offered to nonprofits, and who can use them?
According to Microsoft’s documentation, Microsoft 365 Business Basic is the main cloud offer granted to eligible organizations; other licences come at a discount. Not everyone in the organization qualifies in the same way.
| The person | Donated licence | Discounted licence |
|---|---|---|
| Paid employee of the organization | Yes | Yes |
| Unpaid executive acting in a leadership role | Yes | Yes |
| Volunteer | No | Yes |
| Program participant, member, donor | No | No |
What Microsoft asks in return
One validated environment per organization, and an attestation to renew. An organization that lets donated licences sit idle, or lends them to an entity that is not eligible, risks losing access to the offers.
What we do, and what we do not promise
The application is filed by the organization, in Microsoft’s portal, and the answer is Microsoft’s to give. Once licences are granted, assigning them, securing the accounts and cleaning up access fall under our Microsoft 365 services. OKTO is a Microsoft Partner, which changes nothing about an organization’s eligibility. The application steps are in our guide to free and discounted software for nonprofits.
Volunteers and staff
How do you manage access when people change often?
A nonprofit’s problem is rarely the arrival: someone always ends up creating the account. The problem is the departure. Last summer’s intern can still open the client files. The former treasurer still receives the statements. The volunteer who left on bad terms knows the password to the Facebook page.
The answer is a register: for each role, the list of what it opens. Caseworker, assistant, board member, front-desk volunteer. On arrival, the role’s list is granted and nothing more. On departure, the same list is removed that day, and the mailbox is handed to whoever takes over the files. Our page on employee arrivals and departures lays out the whole method.
For volunteers the rule is simpler still: access in their own name, limited to what they do. Shared accounts are the ones nobody remembers to close.
- One account per person, board members included
- Passwords for social media and donation platforms kept in a vault, not in an email
- An access review on a fixed date, for example after the annual general meeting
The same register read both ways: what was granted on arrival is removed on departure, line by line.
Donors and clients
Which rules govern donor and client information?
Two sets of rules meet. The first is Quebec’s: the private-sector privacy Act, tightened by Law 25, covers the carrying on of an enterprise within the meaning of the Civil Code, that is, an organized economic activity, “whether or not it is commercial in nature”. The Commission d’accès à l’information writes that the Act can also cover nonprofits, but that a case-by-case analysis is needed. Where the Act applies, the person with the highest authority in the organization is by default the one in charge of protecting personal information, unless that function is delegated in writing. Our page on Law 25 details the incident register and the other obligations.
The second is federal and concerns registered charities. The Canada Revenue Agency requires books and records to be kept at the Canadian address on file, in an electronically readable format if they were created that way, and recommends a backup copy stored somewhere else. That is what a backup with an off-site copy does. For donations made online, our website examples for nonprofits show how to present the form and the tax receipt.
- Find the listsThe donor spreadsheet, the export from the donation platform, the registration forms: where are they, and who copied them to a laptop?
- Narrow who can reach themBy role, not by habit. A Microsoft 365 audit shows what is shared with the whole organization.
- Close the front doorMulti-factor authentication on every account, then the other layers of our managed cybersecurity.
- Write down what to do after a mistakeAn email sent to the wrong recipient is an incident. It gets recorded and assessed, and someone knows who to call.
An entry in the register of confidentiality incidents: the date, the nature, the measures taken and the signature of the person in charge.
We are neither lawyers nor auditors. OKTO sets up technical measures that support your obligations and keeps a record of them. Whether an Act applies to your organization, and how far, is something to settle with your legal advisor.
A nonprofit’s calendar
When in the year does an outage cost the most?
| The moment | What is going on | What it takes on the IT side |
|---|---|---|
| The year-end campaign | Donation forms, mailings to donors, the organization’s mailbox: everything is in use at once. | No system changes during those weeks, and someone reachable if the outbox jams |
| The start of the year | Official donation receipts go out. Copies are kept for two years after the end of the calendar year of the gift. | A verified backup of donation data, whether it lives in Prodon, CanadaHelps, Zeffy or a spreadsheet |
| The six months after fiscal year-end | A registered charity files its T3010 return with the Canada Revenue Agency. | Accounting records that are reachable and readable, not locked in a former treasurer’s laptop |
| The annual general meeting | Activity report, financial statements, members’ vote, sometimes remote. | A room and a video call tested the day before, and documents shared through a link that expires |
A tight budget
How do you fit IT into a nonprofit’s budget?
By picking the formula the organization can carry this year, and writing the rest into a plan.
The bank of hours
Prepaid hours, with no monthly commitment, for support, a project or advice. A good way in when a volunteer already handles the day-to-day.
The monthly plan
Base, Standard or Complet, billed per workstation or server. A fixed amount is easier to defend before a board than a string of hourly invoices. Our plans compare line by line, and co-managed IT keeps your volunteer in the picture.
The three-year plan
Which workstations to replace, when, and for how much. A three-year IT plan gives you a number to put in a funding application, instead of an emergency purchase the day the server gives out.
OKTO Solutions is a sponsor of Ékip Jeunesse, which helps young people in Trois-Rivières. That is a sponsorship, not a service contract. How we get involved with organizations is explained in our nonprofit commitment. For travel, see our pages on Trois-Rivières and Quebec City.
Questions and answers
Questions nonprofits ask
Is our nonprofit eligible for donated Microsoft licences?
Microsoft decides, through a validation partner. Its criteria call for recognized legal status and exclude, among others, government bodies, schools, professional associations and political or labour organizations. Microsoft reserves the right to grant or deny an application. We therefore promise nothing before its answer.
Can a volunteer have an email address from the organization?
Yes, but not on a donated licence: Microsoft keeps those for paid employees and unpaid executives. A volunteer can be invited as an external guest with a personal account, or get a discounted licence when an address in the organization’s name is needed.
Does Law 25 apply to a nonprofit?
Quebec’s private-sector privacy Act covers anyone carrying on an enterprise within the meaning of the Civil Code, that is, an organized economic activity, “whether or not it is commercial in nature”. According to the Commission d’accès à l’information, it can therefore cover a nonprofit, but a case-by-case analysis has to establish whether the organization really carries on an organized economic activity, and a lawyer’s help may be needed. The technical measures are the same either way.
How long do donation receipts and records have to be kept?
According to the Canada Revenue Agency, a registered charity keeps copies of official donation receipts for two years after the end of the calendar year of the donations, and its other books and records for six years after the end of the fiscal year they cover. The Agency also recommends keeping a backup copy in another location.
We cannot afford a monthly plan. Where do we start?
With a prepaid bank of hours, in blocks of 10, 20 or 50, and with three moves that cost little: multi-factor authentication on every account, removing access for people who have left, and a backup someone has actually tried to restore. The rest gets planned over more than one fiscal year.
A volunteer looks after our IT. Should we replace them?
No. They know your people better than any provider will. What needs fixing is the dependency: administrator accounts in the organization’s name, with a break-glass account, and a documented environment. Co-managed IT leaves the day-to-day with them and hands us monitoring, security and backups.
Tell us what your budget allows
We look at your workstations, your accounts and where your lists are sitting. We tell you where to start, and what can move to the next funding application.
Reviewed by Antonio Pazzi, president of OKTO Solutions · updated