Nonprofit IT Guide: Discounts, Donor Data, Volunteers

A small nonprofit can get most of its core IT free or heavily discounted, but the offers changed in 2025. As of September 2026, Microsoft grants Microsoft 365 Business Basic free for up to 300 users and discounts Business Premium to $5.50 per user per month, and Google offers a free Workspace for Nonprofits edition. The rest of the job is protecting donor data, keeping card numbers off your own systems, and giving volunteers and board members access you can take back.

What Do Microsoft and Google Offer Nonprofits Right Now?

Microsoft: what changed in 2025

Microsoft used to grant a small number of free Microsoft 365 Business Premium seats. It announced that the Business Premium grant and the Office 365 E1 grant would be discontinued at each nonprofit’s next renewal on or after July 1, 2025. If your organization was set up before then and nobody has reviewed licensing since, check the admin center to confirm which licenses you hold today.

The current offers, from Microsoft’s nonprofit offers page, checked in September 2026:

Offer	Nonprofit price	What it is
Microsoft 365 Business Basic	Free for up to 300 users	Business email on your domain, Teams, 1 TB of cloud storage per user, and the web and mobile versions of Word, Excel, and PowerPoint
Microsoft 365 Business Premium	$5.50 per user per month, paid yearly	Adds the desktop Office apps plus security and device management tools
Microsoft 365 Copilot add-on	$25.50 per user per month, paid yearly	The AI assistant inside the Office apps
Azure	$2,000 in service credits per year	Cloud servers and services
Windows 11 Pro	Grants of up to 50 licenses through TechSoup	Operating system upgrades

The practical difference between the two main plans is the desktop apps and the security tooling. Business Basic users work in a browser or on a phone. Staff who build large spreadsheets, run mail merges, or handle sensitive records are the ones most likely to need Business Premium. A mix is fine: Premium for core staff, Basic for everyone else. Our Business Premium vs Standard comparison explains what the security features do.

Microsoft’s rules worth knowing

Microsoft’s eligibility page and its Learn documentation set conditions that affect how you assign licenses:

• Who qualifies. Nonprofits with recognized legal status (501(c)(3) in the US), public libraries, public museums, and certain US healthcare organizations. Schools, government bodies, professional and trade associations, and political, labor, and fraternal organizations are listed as not eligible.
• Grants are for staff and leadership. Granted (free) licenses may go to paid employees and unpaid executive leadership such as board members and officers. Volunteers are not eligible for granted licenses, but discounted licenses are permitted for all staff, including volunteers and temporary staff.
• Use them or lose them. Microsoft lists failing to keep at least 85% of granted licenses in active use as an example of program abuse. Claim what you need, not the full 300.
• One tenant. Microsoft allows one validated grant tenant per organization.
• Timing. Microsoft says validation can take up to three business days, longer if more documents are needed, and grantees must periodically complete an attestation to stay eligible.

Google

Google’s Workspace offers for nonprofits, as of September 2026:

Edition	Nonprofit price	Storage
Google Workspace for Nonprofits	$0 per user	100 TB shared across all users
Business Standard	$3.50 per user per month with a one-year commitment, or $4.20 billed monthly	2 TB per user
Business Plus	$6.16 per user per month with a one-year commitment, or $7.40 billed monthly	5 TB per user
Enterprise editions	Discounted 70% or more	Contact Google

Google’s eligibility page excludes government entities, hospitals and healthcare organizations, and schools, and says a verification partner confirms your status first.

Which one?

Pick one platform and put everything on it. Running both doubles the accounts to secure and the places a file can hide. If your staff already live in Word and Excel or you want Microsoft’s device management, choose Microsoft. If your people are comfortable in a browser and you want the simplest free option, Google’s free edition is strong. Our Microsoft 365 vs Google Workspace comparison goes through the trade-offs.

TechSoup

TechSoup is a nonprofit that validates organizations and distributes donated and discounted technology from many vendors. Microsoft, for example, routes its Windows 11 Pro grants through it. Check its catalog before paying retail for software, and compare the final cost with the vendor’s own nonprofit price.

Donor Data: What Are You Responsible For?

This section is IT guidance, not legal advice.

The CCPA mostly does not apply, but other California law does. The Attorney General’s CCPA overview says the CCPA generally does not apply to nonprofit organizations. California’s data security statute is broader. Civil Code section 1798.80 defines a business as an organization “whether or not organized to operate at a profit,” and section 1798.81.5 requires such a business to maintain reasonable security for personal information about California residents. If you serve clients as well as donors, case files with Social Security numbers or health details need more care than a mailing list.

Card payments and PCI. The PCI Security Standards Council says the PCI Data Security Standard applies to all entities that store, process, or transmit cardholder data, whatever their size. The way to keep that burden small:

• Take online gifts through a hosted donation page run by your payment or fundraising platform, so card numbers never pass through your website or computers.
• Do not accept card numbers by email, and do not keep them in spreadsheets or on paper pledge cards after processing.
• At events, use the processor’s card readers on a network separate from guest Wi-Fi.

Our PCI DSS guide covers the self-assessment questionnaire.

The donor database. Whatever donor system you use, give each person their own login, turn on multi-factor authentication (a second proof of identity beyond the password), limit who can export the full list, and find out how to get a complete export of your data. Review the user list after each campaign or event.

How Should Volunteer Accounts Work?

Volunteers come and go, which makes shared passwords tempting. A shared login means you cannot tell who did what, and you cannot remove one person without changing the password for everyone.

1. Sort volunteers by what they need. Many need nothing more than a schedule and a group chat. Only those who handle records need an account.
2. Give record-handling volunteers their own account. Under Microsoft’s rules that means a discounted license, not a granted one. Give it an end date.
3. Use groups for permissions. Put volunteers in a group with access to specific folders, not the whole drive.
4. Keep organization data on organization accounts. Personal Gmail addresses collecting donor spreadsheets is how data leaves without anyone noticing.
5. Offboard by checklist. When a volunteer’s term ends, disable the account, remove them from the donor system, and collect any keys or door codes. Our onboarding and offboarding guide has a template.
6. Set a device standard. Volunteers mostly use their own phones and laptops. Require a screen lock and keep files in the cloud, not downloaded. See the BYOD policy guide.

Board Members and Board Documents

Board packets contain budgets, personnel matters, and donor information, and they are usually emailed to personal addresses. Consider:

• A single place for board files. Dedicated board portal products exist, and a restricted SharePoint site or Google shared drive does the job for many small boards.
• Organization accounts for officers. Microsoft’s rules allow granted licenses for unpaid executive leadership, so the treasurer and chair can have accounts you control, with MFA.
• Dual control on money. Impersonating the executive director or treasurer by email to request a transfer or gift cards is a common scam. The FBI’s 2025 Internet Crime Report counted 24,768 business email compromise complaints with about $3.05 billion in reported losses across all kinds of organizations. Require a second approver and verification by phone, using a known number, for any new payee or change of bank details. See the business email compromise guide.
• Term limits for access. Remove portal and email access when a board term ends.

The Risks Specific to Nonprofits

• Licensing surprises after the 2025 Microsoft change, such as expired grants and users without the apps they expect.
• Knowledge held by one person. If a single staff member or volunteer set everything up, make sure the organization holds the administrator logins in a password manager.
• Shared passwords and accounts that outlive the people who used them.
• Donated computers that cannot run Windows 11. Windows 10 support ended on October 14, 2025. See the Windows 10 guide.
• Cloud data without a separate backup. Microsoft and Google keep their services running, but recovering from accidental or malicious deletion is limited by their retention windows. The Microsoft 365 backup guide explains the gap.

Checklist You Can Copy

1. Confirm your nonprofit status is validated with Microsoft or Google, and know who holds the administrator account.
2. Review current licenses against the 2025 Microsoft changes. Assign only what is in use.
3. Email runs on your own domain, with SPF, DKIM, and DMARC records published.
4. Multi-factor authentication is on for every account, including board officers.
5. No shared logins for email, the donor database, or banking.
6. Online donations go through a hosted page. No card numbers in email, spreadsheets, or paper files.
7. Each volunteer who handles records has an individual account with an end date.
8. Board files live in one restricted location.
9. New payees and bank changes require a second approver and phone verification.
10. Cloud data has a separate backup, and a restore has been tested.
11. Every computer runs a supported operating system and is encrypted.
12. Administrator passwords are stored in a password manager that the organization controls.

Questions to Ask Any IT Provider

• Will you help us validate and claim nonprofit offers, and will the licenses be registered to our organization?
• How do you handle volunteer and board accounts, including removal?
• What do you recommend for backup of our cloud data, and what does it cost at nonprofit rates?
• Who will hold administrator access, and how is it documented for us?
• Can the work be scoped as a one-time project if we cannot commit to ongoing support?
• How will you explain the setup so that our board can oversee it?

When You Do Not Need Much

An all-volunteer organization with no office can run well on a free Google or Microsoft tenant, MFA, a password manager, and a hosted donation page. Paid support starts to make sense when you have staff, client records, an office network, or grant requirements that demand documented security.

Common Questions

Is Microsoft 365 still free for nonprofits?

Partly. As of September 2026, Microsoft grants Business Basic free for up to 300 users, which covers email, Teams, storage, and the web and mobile Office apps. The free Business Premium and Office 365 E1 grants ended at renewals on or after July 1, 2025. Business Premium is now a discounted paid plan at $5.50 per user per month, paid yearly.

Can volunteers use our free Microsoft licenses?

Not under Microsoft’s published rules. Granted licenses are for paid employees and unpaid executive leadership such as board members and officers. Volunteers may be assigned discounted nonprofit licenses. Microsoft lists intentional mis-licensing as program abuse, which can cost the organization its access to nonprofit offers.

Does PCI apply if we only take a few donations by card?

Yes. PCI DSS applies to any organization that stores, processes, or transmits cardholder data, regardless of volume. Using a hosted donation page and the processor’s own card readers keeps card data off your systems, which greatly reduces what you have to assess and document.

Do we need a backup if everything is in Google Drive or OneDrive?

A separate backup is worth having. Both services protect against their own hardware failures and offer short-term recovery of deleted items, but neither is designed to restore a whole organization’s files from months ago after a deletion or ransomware event went unnoticed. A third-party backup fills that gap.

How Coastal Growth Co. Can Help

We can validate and set up Microsoft or Google nonprofit licensing, move email to your own domain, secure donor and board data, and build account routines for volunteers. Work can be a one-time project or ongoing support, with scope and price agreed before any paid work. See the nonprofit IT page and cloud, email and AI, then tell us about your organization on the contact page.