For Nonprofits and Foundations
Your donor list, grant books, and payroll sit in inboxes no one is watching and your board is supposed to know about it.
Nonprofits are attractive targets: staff turnover is high, IT budgets are tight, and wire fraud on grant disbursements and payroll is common. SentinelSMB gives your board real evidence of cyber-diligence without a dedicated IT hire. Two flat monthly plans, the same price for every customer.
- Month to month
- No setup fees
- Cancel anytime
Business email compromise losses reported to the FBI in 2025, across 24,768 complaints. Fake invoices and rerouted payments hit nonprofits too.
Credentialed, insured, operational
- RegisteredND LLC
- IRS registeredEIN on file
- E&O insured$1M per claim, $2M total
- EncryptedYour data, at rest and in transit
- Sign-inAlways a second step
- Audit trail365-day retention
Threats we catch
Three attacks aimed at nonprofit organizations.
36 detection engines check your Microsoft 365, Google Workspace, AWS and Cloudflare accounts every five minutes. Critical threats surface instantly. Normal activity gets filed away.
Donor record exposure
Donor tax receipts, planned-giving documents, and CRM exports routinely hold partial SSNs, full addresses, and giving histories. One compromised development-director inbox exposes every donor you have ever solicited.
Grant disbursement redirect
An attacker intercepts a grant-payment email thread, spoofs updated banking instructions, and the funds go to the attacker instead of the grantee. Discovery often takes a full reporting cycle.
Payroll and W-2 harvest
Executive director or HR inbox compromise yields every staff W-2 form. Attackers file fraudulent tax returns in February using real employee data, and the nonprofit carries the reputational hit.
Example alert for a made-up business.
Your blind spot
What a typical IT setup does not watch.
- Volunteer board members and part-time staff routinely get full inbox access on day one — and often retain it months after they leave.
- Grant deadlines create inbox chaos that is perfect cover for an attacker setting up forwarding rules or OAuth grants nobody will review.
- Your annual audit committee asks whether you have monitoring in place — and most nonprofits answer with policies instead of actual evidence.
- One payroll-redirect attack can drain weeks of operating cash — and the recovery is almost impossible for a lean nonprofit.
The screen is an example for a made-up business, not real customer data.
Compliance alignment
The rules and frameworks we line up to.
SentinelSMB provides the continuous-monitoring, access-control, and incident-response controls these frameworks require. Pro subscribers get the audit-ready evidence package.
-
Board fiduciary duty
Duty of care for cyber risk
State nonprofit corporation statutes impose a duty of care on directors. Cybersecurity oversight is part of the risk a board is expected to watch, and a monitoring record shows the board what is actually happening.
-
IRS Form 990 disclosure
Reportable cyber events
Significant cybersecurity incidents and resulting material financial loss can be reportable on Form 990 and related schedules. Having real detection timestamps and incident documentation makes those disclosures accurate and defensible.
-
State charitable solicitation
Breach notification to donors
Every state requires notification to affected individuals when personal information is accessed without authorization. Donors live in every state, so your exposure is nationwide. SentinelSMB produces the detection audit trail regulators require.
-
UPMIFA / endowment oversight
Prudent investor standards
Under the Uniform Prudent Management of Institutional Funds Act, the board must exercise reasonable care in stewarding restricted and endowment funds. Cyber-security over the systems that move those funds is part of that reasonable care.
Can a nonprofit afford this on our budget?
Two flat monthly plans, quoted in writing. Starter covers two platforms. Pro covers all four and includes the board-ready evidence package. No setup fees, cancel in one click.
Does this help with our audit?
Yes, if your auditor asks about cybersecurity controls during the annual review. Pro subscribers get the Cyber Insurance Evidence Report — a documented monitoring record that answers audit-committee questions with real evidence instead of policy statements.
What about our grantors requirements?
If a grantor or funding source asks about cybersecurity in an application or agreement, a monitoring record gives you a real answer instead of a policy statement.
We use Microsoft 365 Nonprofit — does it work?
Yes. SentinelSMB works identically with M365 Nonprofit, M365 Business Basic, and Google Workspace for Nonprofits. The same 36 detection engines, the same plain-English alerts.
What if our volunteers use personal email for our work?
We cannot monitor personal Gmail accounts we are not granted access to. We strongly recommend getting every volunteer who handles donor data or grant correspondence onto your organizational tenant. SentinelSMB makes that monitoring effortless once they are on it.
Protect the mission. Protect the donors. Give your board the answer it wants.
Under 10 minutes to connect. Monitor every staff inbox, every grant email thread, every cloud account around the clock. Cancel anytime.