IT Support for Nonprofits on Google Workspace

The blind spot: one person holds every key

In a lot of small nonprofits, Google Workspace is run by whoever set it up. Often that's the operations director, on top of a full-time job. That person is usually the only super admin. If they leave, lose their phone, or get phished, the organization can lose control of every inbox, shared drive, and donor spreadsheet at once.

We fix that first. There's a second super admin account that nobody uses for daily email, 2-step verification is enforced on every account, and there's a written record of who holds admin rights and why.

Google Workspace administration, taken over or backed up

You choose how much we take on. Some organizations hand us the admin console entirely. Others keep their ops director in charge and want a backstop: someone who knows the setup, can step in when they're out, and handles the parts that are easy to get wrong.

Phishing and identity monitoring for a distributed team

Nonprofits get the same phishing as everyone else, plus a few versions aimed at them: fake invoices, look-alike login pages, and urgent requests that appear to come from the executive director. When the team works from home offices, nobody can lean over and ask whether an email looks right.

So we watch the accounts, not just the inboxes. Identity monitoring flags sign-ins that don't fit, like a login from a country nobody on your team is in, or two sign-ins too far apart to travel between. Security awareness training teaches the team what a phish looks like and where to report it. DNS filtering on staff laptops blocks known-malicious sites wherever people are working.

Contractors: covered per identity, no device management

Nonprofits run on part-timers, contractors, and volunteers who use their own laptops. We don't manage those machines, and you don't pay a full seat for them.

We cover the account instead. 2-step verification is enforced, identity monitoring watches the sign-ins, access is limited to the shared drives and groups the person actually needs, and the account is suspended when the engagement ends. Contractor coverage is priced per identity and quoted with your proposal. It isn't on our published price list.

Mac-first onboarding and offboarding through Apple Business Manager

A new hire's laptop should arrive ready to use. Apple Business Manager is free from Apple. Once it's linked to our device management, a Mac bought through your organization's Apple or reseller account can ship straight to the new hire's home. When they turn it on and connect to Wi-Fi, it enrolls itself, applies your security settings, and installs the apps they need. Nobody has to touch it first.

Departures work the same way in reverse. When a staffer leaves, we can lock or erase their Mac remotely, wherever it is, once it's online. Because the Mac is enrolled through Apple Business Manager, we can prevent or clear Activation Lock, so a former employee's personal Apple Account can't strand it, and after it's erased it re-enrolls itself for the next hire. For the step-by-step version, see managed IT for remote, Mac-first teams or our zero-touch Mac deployment guide.

Hardware for staff you rarely see

Remote staff still need a laptop that works, and someone has to get it to them. We spec the machine for the role, you buy it through a channel that registers it to your Apple Business Manager account, and we coordinate delivery to the person's door. You pay for the hardware. We handle the coordination.

When someone leaves, we coordinate getting the laptop back, erase it, and hand it to the next hire already configured. If it doesn't come back, it stays assigned to your organization in Apple Business Manager, so after a reset it re-enrolls when it's set up online, and it can be locked the next time it connects to the internet.

Salesforce, Asana, Slack, and your donation platform

Your work runs on apps we don't own. We handle the IT side of them: who has access, single sign-on through Google where your plan supports it, and the support ticket with the vendor when something breaks. You get one person to call instead of four support queues. Vendor management is included from Secure Growth up.

Single sign-on is often a paid upgrade inside the app itself, so we check your plan before promising it. Configuration inside those apps or the integrations between them, like building a Salesforce report, a new automation, or a donation form, is project work billed at $175 an hour.

Cost levers: Google for Nonprofits and TechSoup

Before you spend money on software or hardware, check what you can get free or discounted. We walk you through it.

• Google for Nonprofits. Eligible nonprofits can use Google Workspace for Nonprofits at no cost, with discounted pricing on the higher editions. We check whether the free edition covers what you need or whether a discounted higher edition is worth it.
• TechSoup. Donated and discounted software, plus refurbished hardware, for verified nonprofits. It's worth checking before you buy licenses or laptops at full price.
• Ghosxt Cares. Our donated-setup program covers Microsoft 365, domain, email, website, and DNS setup for one Monterey County 501(c)(3) per quarter. Ongoing managed IT is billed at the published prices on this page.

Worked example: a 9-person nonprofit

Nine staff on Google Workspace, mostly on Macs, plus 12 contractors who only need their accounts protected. Here's the math on published prices.

The same example sits next to a professional office and a 3-person shop on our page about what managed IT costs in Monterey County, and every rate comes from our pricing page.

Related