Protect First
Software licence review + Backup & DR + Managed Security, then Managed IT in phase two.
Non-profits and charities
IT and security for non-profits and charities
Three ways to pay for better IT: save first by moving to non-profit software pricing, write the work into your grant budgets, and phase the rest.
Who we work with. Registered charities and not-for-profit corporations in Waterloo Region and southern Ontario: social service agencies, community health centres and hospices, children's aid societies, arts, sport and faith-based community programs, and member organizations such as chambers, associations and BIAs.
Sound familiar?
When organizations like yours call us
- Your IT volunteer is moving on.
- A funder asked how you protect client data.
- You're paying full price for software you could get at non-profit pricing.
- Your donor list lives in one person's spreadsheet.
- You want to use AI without sending client data to public tools.
Rules that apply
What the rules ask of you
General information, not legal advice. Use the compliance guide's filter for your exact profile. Last verified: November 6, 2026.
Privacy
- PIPEDA usually doesn't apply to non-profits, and Ontario has no general private-sector privacy law.
- It does apply to commercial activity outside your mandate, such as selling, bartering or renting donor or member lists. That needs express opt-in consent; an opt-out checkbox was ruled invalid in 2023.
- Donor and client trust is at stake either way.
- PHIPA applies to hospices, community health centres and other health providers.
CASL (email)
- Registered charities' fundraising emails are exempt from the consent and unsubscribe rules.
- Gift-shop sales, sponsor promotions and emails from unregistered non-profits are not.
- Implied consent from a donation, volunteering or membership lasts 2 years.
- Penalties reach $10 million per violation for organizations.
Employment and accessibility
- AODA, electronic monitoring and job-posting rules apply to non-profit employers the same way as businesses.
CRA charity records
- Financial records, source documents and T3010 copies: 6 years from the end of the last tax year they relate to.
- Donation receipt copies: at least 2 years.
- Governing documents and minutes: while registered, plus 2 years after revocation.
- Kept at a Canadian address on file with the CRA.
Children's aid societies
- Ontario's public-sector cyber rules apply (see the children's aid page).
Recommended
Where to start
Bundles are quoted for your organization. Each one is built from services you can also buy on their own.
Grant-Ready Assessment
A Security Assessment with a one-page funder summary and a costed roadmap for grant applications.
Children's Aid Cyber Program
Maturity assessment using a Ministry-endorsed standard, Managed Security with round-the-clock detection, an incident plan with a 72-hour reporting runbook, Managed Compliance, and yearly training.
Donor Growth Web Pack
An accessible website, care plan, Google Ad Grants conversion tracking, and CASL-ready sign-up forms.
Member Cyber Program
Training workshops and quick assessments delivered to your members.
Funding that may help
Ways to pay for it
You may qualify; we never promise funding. Last verified: November 6, 2026.
Use the eligibility checkerFunding and donated technology. The Ontario Job Grant covers non-profit employers but excludes children's aid societies, hospitals and school boards. FedDev RTRI also supports organizations that help businesses adapt, grow and trade.
Ontario Trillium Foundation: SeedOntario Trillium Foundation: GrowOntario Trillium Foundation: CapitalOntario Job GrantCanada Summer Jobs 2027FedDev RTRI (support for organizations that help businesses)CIRA Net GoodOntario Skills Development Fund (Training Stream)Waterloo Region Community Foundation: Community GrantsMicrosoft for NonprofitsGoogle for Nonprofits (incl. Ad Grants)AWS Imagine GrantTechSoup
FAQ
Questions we hear
Can we write IT into a grant?
Often, as purchased services inside a project budget. Our Grant-Ready Assessment gives you a one-page funder summary and a costed roadmap to attach.
Do our fundraising emails need consent?
Registered charities' fundraising emails are exempt from CASL's consent and unsubscribe rules. Gift-shop sales, sponsor promotions and emails from unregistered non-profits are not.
Start here
Find out where you stand, at a fixed price.
A short discovery call, then a fixed-price assessment with a ranked, costed roadmap: what to fix first, what it costs, and what funding may help.