How to Choose an IT Provider for Your Nonprofit
Most Canadian nonprofits end up choosing an IT provider one of two ways: a board member's cousin does it as a favour, or a generic local MSP is hired because they were first to answer the phone. Neither approach accounts for what actually makes IT support work for a charity - tight budgets, high volunteer turnover, donor data that carries real legal obligations, and grant funders who increasingly ask about your security posture. This is the checklist we'd want a nonprofit to walk through before signing with anyone, including us.
Ask About Nonprofit-Specific Experience
A provider that mainly serves law firms or retail stores will configure your environment the same way regardless of who you are. Ask directly: how many nonprofit or charity clients do you currently support? Do you know how Microsoft's nonprofit licensing program works, and have you actually set one up through TechSoup Canada? Do you understand PIPEDA's requirements for donor data, or will you need to learn on your account? A provider with real nonprofit experience should be able to name the CRM platforms they've supported (Salesforce NPSP, Blackbaud, Bloomerang, DonorPerfect and similar), not just say 'we can support any system.'
Understand the Pricing Model
Two pricing models dominate IT support: flat-rate managed services (a predictable per-user or per-month fee that includes support, monitoring and maintenance) and break-fix or hourly billing (you pay only when something breaks). Break-fix sounds cheaper until you need it during a donor-database outage the week before a fundraising deadline. Ask for the full pricing structure in writing, not just a headline number: what's included, what's billed separately, and whether there's a nonprofit discount and what it actually requires (most nonprofit discount programs require a valid CRA charitable registration number). Be wary of a quote that can't explain what happens when you exceed a support-hour cap.
Confirm Security Fundamentals Are Included, Not Extras
Multi-factor authentication, endpoint protection, encrypted backups and email anti-phishing controls should be part of the base managed IT service, not a separate upsell you have to negotiate for later. Ask specifically whether security awareness training for staff and volunteers is included, and how often - a once-a-year session doesn't reach volunteers who only serve for a few weeks or months. If a provider can't clearly describe their backup and disaster-recovery process, including how often restores are actually tested, that's worth pausing on.
Ask How Volunteer Access Is Managed
This is the question that separates nonprofit-experienced providers from generalists. Nonprofits lose track of volunteer accounts constantly - someone helps out for a season, then moves on, and their login to the donor database or shared drive never gets deactivated. Ask how the provider handles onboarding and offboarding for short-term volunteers specifically, not just full-time staff. A provider without a clear, documented answer here is going to leave this problem for you to manage yourself.
Response Time and Support Model
Ask what happens when something breaks: is there a documented response-time commitment, and does it differ for a minor issue versus something that stops your organization from operating? Ask whether support is unlimited or capped, whether it's remote-only or includes on-site visits when needed, and who you actually talk to - a dedicated point of contact, or a different technician every time you call. A provider that can't describe their support process clearly and specifically, in plain terms, is not going to explain it any better after you've signed.
Red Flags to Watch For
No nonprofit or charity references they can point to. Pricing that can't be explained without a sales call. No mention of security awareness training when you ask about ongoing protection. Vague answers about where your data is stored, or no awareness that Canadian data residency matters for some PIPEDA-sensitive organizations. A single generalist rather than a team, which becomes a real problem the day that person is unavailable during an outage. None of these disqualify a provider on their own, but more than one should prompt a harder look before you commit.
How We Compare
Nonprofit IT Solutions, a division of Group 4 Networks, has worked exclusively with Canadian charities and nonprofits since 2008. Our managed IT plans start from $99/user/month with up to a 25% discount for registered Canadian charities, and include the security fundamentals - MFA, endpoint protection, encrypted backups, email security - as part of the base service rather than an add-on. We handle the Microsoft nonprofit licensing application directly, deliver ongoing security awareness training through SecureAware, and have a documented process for volunteer onboarding and offboarding built specifically around nonprofit turnover. If you're evaluating providers, we're happy to answer the same questions in this checklist directly. Contact us at (416) 623-9677 or request a free nonprofit IT assessment at nonprofititsolutions.com.
Connect on LinkedIn →
Contact us at (416) 623-9677 or visit nonprofititsolutions.com for a free nonprofit IT assessment.