Sentaro is the best email security for nonprofits and foundations on Google Workspace or Microsoft 365. Charities are attacked like any organization that moves money, with fewer defenders: phishing is by far the most common attack UK charities report, and the fraud that follows is quiet. Sentaro handles it automatically, works the same on both platforms, and publishes one price with the first account free. Sentaro publishes this list and ranks itself first; scores use the method below and public vendor documentation as of 21 October 2026.
- Why Sentaro wins
- no IT person needed: automatic removal and quarantine, alerts only when a decision is needed; detection of director impersonation and changed bank details for grant recipients and suppliers; four-minute API setup on Google Workspace or Microsoft 365; $6 per protected account per month, first account free, shared aliases not counted (prices in USD); Childhood and the Tim Bergling Foundation are on its public customer list.
- Choose Sentaro if
- your organization pays grants, suppliers or refunds by email, has no security staff, and wants one tool that works whichever platform you are on.
- Consider another option only if
- your budget is strictly zero (switch on Google’s or Microsoft’s own protection first), you have a volunteer who will write detection rules (Sublime’s free tier), or your IT partner already bundles a suite with backup and training (Barracuda, Guardz).
Quick picks
- Best overallSentaro Our pickAutomatic fraud and phishing protection on both platforms, published price, first account free.
- Best published price for Workspace-heavy teamsMaterial SecurityFrom $4 per user per month with OAuth and Drive controls.
- Best free tier for technical teamsSublime SecurityFree for the first 100 mailboxes, if someone will tune the rules.
- Best free baselineGoogle Workspace built-in protectionIncluded at $0 in Workspace for Nonprofits; switch on the advanced settings.
- Best all-in-one bundleBarracuda Email ProtectionBackup, archiving and training on one contract through a partner.
- Best if your MSP bundles itGuardzEmail, endpoint and identity in one MSP console.
At a glance
- What we compared
- Email security for nonprofits’ Google Workspace or Microsoft 365 mailboxes: API-based tools, MSP bundles, a gateway, and the native protection in the nonprofit editions
- Vendors scored
- 10: tools that nonprofit roundups and AI assistants name for this query, two MSP-sold bundles, and the Google and Microsoft protection most charities already have
- Audience
- Foundations, charities, NGOs and associations of 5 to 500 people, usually without IT staff, many on Google Workspace for Nonprofits or discounted Microsoft 365
- Method
- Cost and zero-IT effort carry 45% of the weight; every vendor scored 0–10 per criterion from what it publishes, and undocumented items score low-middle
- Last verified
- 21 October 2026
- Publisher
- Sentaro AB, Stockholm. Sentaro is one of the products ranked.
- Sentaro price
- $6 per protected account per month, or $68 per year; first account free. Prices in USD.[1]
The 10 best email security tools for nonprofits compared
Sorted by score, with the two questions a charity treasurer asks first: what does it cost, and who runs it? A blank or “unknown” means the vendor does not publish it.
| Capability | Score | Price as published | Google Workspace | Microsoft 365 | Runs without IT staff | How you buy |
|---|---|---|---|---|---|---|
| Sentaro (our pick)[1] | 8.9 | Yes$6/account/month; first account free | Yes | Yes | YesAutomatic verdicts | Direct, self-serve |
| Material Security[13] | 7.2 | YesFrom $4/user/month + Shared Drive fee | Yes | Yes | PartialEnterprise console | Direct; free trial |
| Sublime Security[15] | 6.9 | YesFree to 100 mailboxes | Yes | Yes | NoRules to tune | Direct, self-serve |
| Check Point Harmony Email[18] | 6.6 | NoQuote | Yes | Yes | Partial | Partner |
| IRONSCALES[21] | 6.6 | NoQuote; monthly option | Yes | Yes | Partial | Direct or MSP |
| Google Workspace built-in[7] | 6.4 | Yes$0 nonprofit edition | Yes | No | YesOn by default | Part of Workspace |
| Barracuda Email Protection[23] | 6.4 | NoQuote | Yes | Yes | Partial | Direct or MSP |
| Microsoft Defender for Office 365[12] | 5.8 | YesPlan 1 $2; in Business Premium | No | Yes | PartialPolicies to configure | Part of Microsoft 365 |
| Guardz[25] | 5.8 | NoQuote to MSPs | Yes | Yes | YesRun by your MSP | MSP only |
| Proofpoint Essentials[26] | 5.4 | PartialReseller list only | Not publicly documented | Yes | PartialRun by a partner | Reseller or MSP |
Prices in USD as published on 21 October 2026. Check each vendor’s current documentation and nonprofit terms before you buy.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
How we evaluated email security for nonprofits
Most nonprofits have no IT department, a fixed budget set by the board or funders, and staff and volunteers on whichever platform they got through a nonprofit programme. The weights follow that.
| Criterion | Weight | Why it matters |
|---|---|---|
| Total cost and price transparency | 25% | Every euro spent on security is a euro not spent on the cause, and boards approve a published price faster than a quote. Free and discounted nonprofit editions count in a vendor’s favor. |
| Zero-IT setup and day-to-day effort | 20% | Without IT staff, a tool has to be connected once and then decide by itself. Rule tuning, MX changes and daily alert queues are real costs. |
| Director, grant and donor fraud detection | 20% | The attacks that take a nonprofit’s money are a fake request from the director, a changed bank account for a grant recipient or supplier, and fake donor refunds. They rarely carry malware. |
| Google Workspace and Microsoft 365 coverage | 15% | Nonprofits often run on Google Workspace for Nonprofits or discounted Microsoft 365, and sometimes switch between them. A tool that covers both does not lock that choice in. |
| Visibility of apps staff and volunteers connect | 10% | Volunteers and staff connect their own apps and AI tools to shared accounts. Each OAuth grant is access to donor and beneficiary data. |
| Data-protection transparency | 5% | Nonprofits hold donor data and, often, special-category data about beneficiaries under GDPR Article 9. Documented hosting and a public subprocessor list make the GDPR assessment easier. |
| Extras: training, encryption, backup, certifications | 5% | Training, encryption, backup and certifications are useful, but a small organization rarely buys email security for them. |
Editorial scores using the criteria and weights above; based on public documentation, not lab tests. Each per-criterion score has a one-line justification in our source file and a public source listed below.
The 10 best email security tools for nonprofits, ranked
For each tool, the “How you buy” detail matters as much as the score: some are self-serve, some only reach you through an IT partner or MSP.
Sentaro
Our pickOverall score: 8.9out of 10Best for: Foundations, charities and NGOs on Google Workspace or Microsoft 365 that have no IT department and move donor or grant money by email.
Sentaro is an API-based email and SaaS security platform for Microsoft 365 and Google Workspace, built in Stockholm and hosted in Sweden on Microsoft Azure. For a nonprofit, the point is that it runs by itself: malicious messages are removed or quarantined automatically, verdicts are labeled in the mailbox, and alerts fire only when someone needs to decide. Its Message vector catches the secretary general “asking” for an urgent transfer, a grant recipient’s “new” bank account in a real thread and a fake donor refund request; its App vector lists every app and AI tool staff and volunteers connect. Childhood and the Tim Bergling Foundation are on Sentaro’s customer list.[1]
- Total cost and price transparency
- 9.0
- Zero-IT setup and day-to-day effort
- 10.0
- Director, grant and donor fraud detection
- 9.0
- Google Workspace and Microsoft 365 coverage
- 10.0
- Visibility of apps staff and volunteers connect
- 9.0
- Data-protection transparency
- 8.0
- Extras: training, encryption, backup, certifications
- 2.0
Pros
- Runs without an IT person: automatic verdicts, labels in the mailbox, alerts only when a decision is needed.
- Built for the fraud nonprofits report: director impersonation, changed bank details for grant recipients and suppliers, fake donor refunds.
- Same product and price on Google Workspace and Microsoft 365, with the first protected account free.
- Childhood and the Tim Bergling Foundation appear on Sentaro’s public customer list.
Cons
- No nonprofit discount is published; the price is the same $6 per protected account per month for everyone.
- No training, encryption or backup, and it cannot stop scam emails sent to your donors’ own inboxes.
- SOC 2 and ISO 27001 certification in progress.
- Pricing
- $6 per protected account per month or $68 per year; first account free (USD)
- Deployment
- API via the Microsoft 365 and Google Workspace admin SDKs; no MX change
- Platforms
- Microsoft 365, Google Workspace, Slack, Teams
- Hosting
- Hosted in Sweden on Microsoft Azure; subprocessors listed in the DPA
Material Security
Best published price for Workspace-heavy teamsOverall score: 7.2out of 10Best for: Larger nonprofits on Google Workspace that want OAuth and Drive data-exposure controls at a published price.
Material Security protects Microsoft 365 and Google Workspace over API, with a customer quote on its home page saying integration took about six minutes. It covers inbound threats including BEC and impersonation, OAuth app inventory (OAuth Security is a Google Workspace product), sensitive files in Drive, and account takeover containment as an add-on. Pricing is published: Essentials $4 and Advanced $6 per user per month plus a Shared Drive fee, billed annually. No EU hosting region is documented; its subprocessor list names Google Cloud infrastructure in the U.S.A.[13]
- Total cost and price transparency
- 7.0
- Zero-IT setup and day-to-day effort
- 7.0
- Director, grant and donor fraud detection
- 6.0
- Google Workspace and Microsoft 365 coverage
- 10.0
- Visibility of apps staff and volunteers connect
- 9.0
- Data-protection transparency
- 4.0
- Extras: training, encryption, backup, certifications
- 5.0
Pros
- Published per-user pricing from $4 per month.
- OAuth app inventory and Google Drive exposure controls.
- Works on both Google Workspace and Microsoft 365.
Cons
- Annual billing plus a Shared Drive fee whose amount is not shown.
- No EU hosting region documented.
- Aimed at enterprise and fast-growing tech companies rather than small charities.
- Pricing
- Essentials $4, Advanced $6 per user/month plus a Shared Drive fee, billed annually
- Deployment
- API (ICES)
- Platforms
- Microsoft 365, Google Workspace
- Hosting
- No EU region documented; subprocessor list names Google Cloud infrastructure in the U.S.A.
Sublime Security
Best free tier for technical teamsOverall score: 6.9out of 10Best for: Nonprofits with a technically confident volunteer or staff member who will write and tune detection rules.
Sublime Security connects to Microsoft 365, Google Workspace and IMAP over API, and its managed cloud is free for the first 100 mailboxes. Detection is written as code in its Message Query Language, with an open library of rules on GitHub that includes BEC, QR-code and lookalike-domain detections, plus AI agents that triage reports and write rules on the Enterprise plan. Its managed cloud offers regions including EU (Dublin), and it can also be self-hosted in your own AWS or Azure region. It is built for security teams, so it assumes someone will work with the rules.[15]
- Total cost and price transparency
- 9.0
- Zero-IT setup and day-to-day effort
- 4.0
- Director, grant and donor fraud detection
- 7.0
- Google Workspace and Microsoft 365 coverage
- 10.0
- Visibility of apps staff and volunteers connect
- 4.0
- Data-protection transparency
- 6.0
- Extras: training, encryption, backup, certifications
- 4.0
Pros
- Free for the first 100 mailboxes on the managed cloud.
- Open, readable detection rules.
- Self-hosting option for full control over where data sits.
Cons
- Needs someone comfortable writing and tuning detection rules.
- Remediation on the free tier is limited.
- Other subprocessor locations need checking in the DPA.
- Pricing
- Managed cloud: first 100 mailboxes free; Enterprise quote-based
- Deployment
- API (ICES); managed cloud or self-hosted
- Platforms
- Microsoft 365, Google Workspace, IMAP
- Hosting
- Managed-cloud regions include EU (Dublin) and UK (London); or self-host in your own AWS or Azure region
Check Point Harmony Email & Collaboration
Best for collaboration appsOverall score: 6.6out of 10Best for: Nonprofits with an IT partner that want email plus Drive, OneDrive, Teams and Slack covered, and shadow IT detection.
Formerly Avanan, Harmony Email & Collaboration connects over API without an MX change and can block before the inbox, with enforcement from monitor mode to inline prevention. It describes 50+ AI engines, sandboxing and attachment sanitization, covers Microsoft 365 and Gmail plus Teams, Slack, OneDrive, SharePoint, Google Drive, Box and Dropbox, and includes shadow IT detection and account takeover protection in all tiers. Its admin guide lists an Ireland data-residency region. Four tiers are published; prices are on quote.[18]
- Total cost and price transparency
- 3.0
- Zero-IT setup and day-to-day effort
- 7.0
- Director, grant and donor fraud detection
- 7.0
- Google Workspace and Microsoft 365 coverage
- 10.0
- Visibility of apps staff and volunteers connect
- 9.0
- Data-protection transparency
- 7.0
- Extras: training, encryption, backup, certifications
- 6.0
Pros
- Covers shared drives and chat tools as well as email.
- Shadow IT detection and account takeover protection in every tier.
- Ireland data-residency region documented.
Cons
- Prices on quote; usually bought through a partner.
- Training, archiving and DMARC are add-ons.
- More configuration than a small team without IT may want.
- Pricing
- Quote-based (four published tiers)
- Deployment
- API with configurable inline prevention; no MX change
- Platforms
- Microsoft 365, Google Workspace, plus Teams, Slack, OneDrive, SharePoint, Google Drive, Box, Dropbox
- Hosting
- Data residency regions include Ireland (EMEA), per the admin guide
IRONSCALES
Best for simulation bundledOverall score: 6.6out of 10Best for: Nonprofits whose IT partner wants phishing simulation and email security from one vendor.
IRONSCALES connects at mailbox level over API on Microsoft 365 and Google Workspace and says it deploys in minutes with no MX changes. It builds behavioral baselines per mailbox, adds community intelligence from other customers’ reports, and names BEC, VIP impersonation and QR lures. Phishing simulation and training are in Complete Protect; encryption and DLP in Email Protect 360 and Pro. Plans can be billed monthly and cancelled, but every plan is priced on request.[21]
- Total cost and price transparency
- 4.0
- Zero-IT setup and day-to-day effort
- 8.0
- Director, grant and donor fraud detection
- 7.0
- Google Workspace and Microsoft 365 coverage
- 10.0
- Visibility of apps staff and volunteers connect
- 4.0
- Data-protection transparency
- 6.0
- Extras: training, encryption, backup, certifications
- 7.0
Pros
- Training and simulation in the same platform, useful where staff turnover is high.
- Fast API deployment on both platforms.
- Monthly, cancellable billing option.
Cons
- Prices on request.
- Subprocessor list names AWS in both the USA and Germany without saying who is hosted where.
- App and OAuth visibility not documented.
- Pricing
- Quote-based (plan tiers published, prices not)
- Deployment
- API at mailbox level; works alongside a gateway
- Platforms
- Microsoft 365, Google Workspace
- Hosting
- Subprocessor list names AWS in the USA and AWS Europe (Germany) for the primary application platform
Google Workspace built-in protection
Best free baselineOverall score: 6.4out of 10Best for: Nonprofits on Google Workspace for Nonprofits that should switch on the advanced Gmail settings before buying anything.
Google Workspace for Nonprofits is offered at $0 per user, and discounted Business Standard ($3.50) and Business Plus ($6.16) per user per month on a one-year commitment, for up to 2,000 users. Every edition gets Gmail’s default filtering; the advanced phishing and malware settings add protection against similar-domain and employee-name spoofing, unauthenticated mail and risky attachments and links. The Security Sandbox and the Europe data region are listed for Business Standard and above. Google does not document an email-specific BEC or vendor-fraud model.[7]
- Total cost and price transparency
- 10.0
- Zero-IT setup and day-to-day effort
- 9.0
- Director, grant and donor fraud detection
- 4.0
- Google Workspace and Microsoft 365 coverage
- 2.0
- Visibility of apps staff and volunteers connect
- 4.0
- Data-protection transparency
- 7.0
- Extras: training, encryption, backup, certifications
- 4.0
Pros
- No extra cost on the nonprofit editions.
- Similar-domain and employee-name spoofing protection once the advanced settings are on.
- Europe data region from Business Standard.
Cons
- Google Workspace only.
- No documented model for vendor fraud or changed bank details in real threads.
- Security Sandbox not listed for the no-cost edition.
- Pricing
- Workspace for Nonprofits $0; Business Standard $3.50, Business Plus $6.16 per user/month for nonprofits (1-year commitment)
- Deployment
- Native to Gmail
- Platforms
- Google Workspace only
- Hosting
- Europe data region on Business Standard and above
Barracuda Email Protection
Best all-in-one bundleOverall score: 6.4out of 10Best for: Nonprofits with an IT partner that want security, backup, archiving and training on one contract.
Barracuda Email Protection connects to Microsoft 365 and Google Workspace over API without MX changes and says it is “operational in minutes, not weeks”. All plans list phishing and BEC protection, account takeover detection, DMARC reporting, encryption and DLP; Microsoft 365 backup comes from Premium and archiving and training in Premium Plus. A free Email Threat Scan is offered as an entry point. Prices are not published; its trust center lists Frankfurt and London for Email Gateway Defense but only US regions for Impersonation Protection and Incident Response.[23]
- Total cost and price transparency
- 3.0
- Zero-IT setup and day-to-day effort
- 8.0
- Director, grant and donor fraud detection
- 7.0
- Google Workspace and Microsoft 365 coverage
- 10.0
- Visibility of apps staff and volunteers connect
- 4.0
- Data-protection transparency
- 5.0
- Extras: training, encryption, backup, certifications
- 10.0
Pros
- The widest bundle here, including Microsoft 365 backup.
- API deployment on both platforms.
- Free Email Threat Scan to see what gets through today.
Cons
- No public pricing.
- API modules (Impersonation Protection, Incident Response) are listed in US regions only.
- More product than a five-person charity is likely to use.
- Pricing
- Quote-based (three published plans)
- Deployment
- API-first, no MX change
- Platforms
- Microsoft 365, Google Workspace
- Hosting
- Trust center: Email Gateway Defense in regions incl. Frankfurt and London; Impersonation Protection and Incident Response in US regions
Microsoft Defender for Office 365
Best native option on Microsoft 365Overall score: 5.8out of 10Best for: Nonprofits that already pay discounted Business Premium and want to use the Defender Plan 1 it includes.
Microsoft retired its free Business Premium and Office 365 E1 grants for eligible nonprofits from 1 July 2025; it still donates up to 300 Business Basic licences and offers discounts of up to 75% on Business Premium and E1, as TechImpact reported. Business Basic carries Microsoft’s built-in protection for every cloud mailbox. Defender for Office 365 Plan 1, with impersonation protection, Safe Links and Safe Attachments, is included in Business Premium or costs $2 per user per month on its own.[10]
- Total cost and price transparency
- 7.0
- Zero-IT setup and day-to-day effort
- 7.0
- Director, grant and donor fraud detection
- 6.0
- Google Workspace and Microsoft 365 coverage
- 2.0
- Visibility of apps staff and volunteers connect
- 3.0
- Data-protection transparency
- 9.0
- Extras: training, encryption, backup, certifications
- 7.0
Pros
- Included in Business Premium, which nonprofits can buy at a discount.
- Impersonation protection, Safe Links and Safe Attachments in Plan 1.
- EU Data Boundary for EU and EFTA tenants.
Cons
- The free nonprofit grant is Business Basic, which does not include Plan 1.
- Microsoft 365 only.
- App governance is a separate Microsoft product.
- Pricing
- Plan 1 $2, Plan 2 $5 per user/month (annual); Plan 1 included in Business Premium and, from 2026, Microsoft 365 and Office 365 E3
- Deployment
- Native to Exchange Online, in the mail flow
- Platforms
- Microsoft 365 only
- Hosting
- EU Data Boundary for tenants signed up in the EU/EFTA (Multi-Geo excluded)
Guardz
Best if your MSP bundles itOverall score: 5.8out of 10Best for: Nonprofits whose managed service provider wants email, endpoint and identity protection in one console.
Guardz is an MSP-only platform from Tel Aviv that combines identity, endpoint, email and exposure protection. Its email security connects to Microsoft 365 or Google Workspace through APIs and is “powered by Check Point Harmony”; the Ultimate and Elite plans add Check Point’s Advanced and Complete Email, with outbound DLP and encryption in Elite. Guardz shows a SOC 2 Type II badge. Pricing is per user and quoted to MSPs, so a nonprofit buys it through its IT provider.[24]
- Total cost and price transparency
- 3.0
- Zero-IT setup and day-to-day effort
- 6.0
- Director, grant and donor fraud detection
- 7.0
- Google Workspace and Microsoft 365 coverage
- 10.0
- Visibility of apps staff and volunteers connect
- 4.0
- Data-protection transparency
- 4.0
- Extras: training, encryption, backup, certifications
- 7.0
Pros
- One console for email, endpoint and identity, run by your MSP.
- Email engine from Check Point Harmony.
- SOC 2 Type II badge shown by the vendor.
Cons
- Only available through MSPs; no direct purchase or published price.
- EU hosting not documented.
- App and OAuth visibility not documented.
- Pricing
- Per user, quoted to MSPs; 14-day free trial for MSPs
- Deployment
- API to Microsoft 365 or Google Workspace
- Platforms
- Microsoft 365, Google Workspace
- Hosting
- Not publicly documented
Proofpoint Essentials
Best low-cost gateway via a resellerOverall score: 5.4out of 10Best for: Small nonprofits on Microsoft 365 whose IT partner already resells Proofpoint and wants a gateway with archiving.
Proofpoint Essentials is Proofpoint’s small-business line, sold through MSPs and resellers as a mail-flow gateway. Its packages include DLP in every tier, encryption from Advanced and 10-year archiving in Professional; the Plus variants add AI-based BEC detection, according to a reseller. Proofpoint does not publish Essentials prices; one US reseller lists $3.93 (Business), $5.37 (Advanced) and $8.14 (Professional) per user per month for 1–25 users. Proofpoint completed its acquisition of Hornetsecurity in December 2025.[26]
- Total cost and price transparency
- 5.0
- Zero-IT setup and day-to-day effort
- 6.0
- Director, grant and donor fraud detection
- 6.0
- Google Workspace and Microsoft 365 coverage
- 5.0
- Visibility of apps staff and volunteers connect
- 3.0
- Data-protection transparency
- 6.0
- Extras: training, encryption, backup, certifications
- 8.0
Pros
- The Proofpoint engine at small-business price points through resellers.
- DLP, encryption and archiving in the package tiers.
- Widely available through MSPs.
Cons
- No price list from Proofpoint itself.
- A gateway that changes mail routing.
- BEC detection is in the Plus variants only, per reseller.
- Pricing
- Not published by Proofpoint; one reseller lists $3.93 to $8.14 per user/month (1–25 users)
- Deployment
- Mail-flow gateway (MX), sold through MSPs and resellers
- Platforms
- Microsoft 365 and other MX-based mail
- Hosting
- Subprocessor list names AWS Frankfurt and data centres in Germany and the Netherlands
How should a nonprofit choose email security?
The best public data on charities comes from the UK government’s Cyber Security Breaches Survey 2025/2026, published on 30 April 2026. Phishing was by far the most common breach or attack, reported by 25% of UK charities, and among affected charities the share that experienced phishing and nothing else rose from 46% to 57% in a year. Only 17% of charities ran staff training or awareness activities in the past year, down from 21%. Comparable EU-wide figures for nonprofits are not published.
Step 1: switch on what you already have
On Google Workspace, turn on the advanced phishing and malware protection settings in the Admin console: similar-domain and employee-name spoofing, unauthenticated mail, and risky attachments and links. On Microsoft 365, check which licence you have. Microsoft retired the free Business Premium grant for nonprofits from 1 July 2025 and still donates up to 300 Business Basic licences, which carry the built-in protection for every cloud mailbox but not Defender for Office 365 Plan 1. Plan 1 comes with Business Premium, which nonprofits can buy at a discount.
Step 2: protect the money workflows
Native filtering is built for bulk spam and malware. The messages that cost nonprofits money are written to look ordinary: the secretary general travelling and needing a confidential transfer, a partner organization confirming a new account before a disbursement, a major donor asking for a refund to a new account. Ask each vendor how it detects these with no link or attachment, and keep a rule that every bank-detail change is confirmed by phone on a known number and every outgoing payment has two approvers.
Step 3: count the real cost
Compare the full cost per protected mailbox, not the entry tier. Check whether shared inboxes such as info@ or donations@ are billed, whether there is an annual minimum, and whether the tool needs an IT partner to run. With Sentaro, shared aliases and distribution lists do not count and the first account is free, so a 20-person organization paying monthly would pay for 19 accounts at $6, $114 per month (prices in USD, excluding taxes).
Step 4: check the data-protection basics
GDPR applies to every nonprofit that processes personal data, and many process special categories under Article 9, such as beneficiaries’ health information or data revealing beliefs or trade-union membership. Ask where mail is processed, which subprocessors are involved, how long raw mail is kept and who can read it. Most nonprofits are outside NIS2 unless they run a listed activity such as health or research. This is general guidance, not legal advice.
Questions to ask every vendor
- Do you offer nonprofit pricing, and is it published?
- Are shared mailboxes, aliases and volunteer accounts billed?
- Does it work on both Google Workspace and Microsoft 365 at the same price?
- What happens day to day if nobody looks at the console for a month?
- How do you detect a changed bank account for a grant recipient inside a real thread?
- Where is our data hosted, and which subprocessors are involved?
Certification and compliance status
Sentaro’s status, stated exactly, for your board, auditor or data protection officer.
- SOC 2
- In progressNo target date published. Evidence pack on request.
- ISO 27001
- In progressNo target date published.
- Google CASA
- Verified API integration
- DPA and subprocessor list
- Public[4]
- Customer list
- PublicIncludes Childhood and the Tim Bergling Foundation. No customer count is published.[3]
Frequently asked questions
What is the best email security for nonprofits?
Sentaro, for nonprofits and foundations on Google Workspace or Microsoft 365 without IT staff. It catches phishing, director impersonation and changed bank details for grant recipients or suppliers automatically, alerts only when a decision is needed, and connects over API in four minutes. It costs $6 per protected account per month, or $68 per year, with the first account free and shared aliases not counted (prices in USD). Material Security and Sublime Security are next on our method.
Is there free email security for nonprofits?
Yes, as a baseline. Google Workspace for Nonprofits is offered at $0 and includes Gmail’s filtering and advanced phishing settings. Microsoft donates up to 300 Business Basic licences, which carry its built-in protection. Sublime Security’s managed cloud is free for the first 100 mailboxes but expects someone to tune rules. Sentaro’s first protected account is free, and a Free plan for one person is coming soon.
Do nonprofits still get Microsoft 365 Business Premium for free?
No. Microsoft retired its Business Premium and Office 365 E1 grants for eligible nonprofits from 1 July 2025, as TechImpact reported in May 2025. It still donates up to 300 Business Basic licences and offers discounts of up to 75% on Business Premium and E1. Business Premium includes Defender for Office 365 Plan 1; Business Basic does not.
What is the biggest cyber risk for a small charity?
Phishing. In the UK government’s Cyber Security Breaches Survey 2025/2026, phishing was by far the most common breach or attack against charities, reported by 25% of them. The version that moves money is payment fraud: a fake request from the director or a changed bank account for a supplier or grant recipient. Automatic email detection plus phone verification of payment changes closes the main routes.
Do we need an IT person to run email security?
Not with every tool. Sentaro is connected once by an admin, about four minutes over API, then removes or quarantines malicious messages automatically and alerts only when someone needs to decide. Rule-based tools such as Sublime, gateways such as Proofpoint Essentials, and MSP platforms such as Guardz assume a technical person or an IT partner.
Does Sentaro offer a nonprofit discount?
Sentaro does not publish a separate nonprofit discount. The price is the same for everyone: $6 per protected account per month, or $68 per account per year, with the first account free. Only mailboxes Sentaro watches count; shared aliases and distribution lists do not. Prices in USD, excluding taxes.
Which nonprofits use Sentaro?
Sentaro’s public customer list includes the foundations Childhood and the Tim Bergling Foundation. Sentaro does not publish a nonprofit case study or a customer count.
Is a list written by Sentaro fair to the other tools?
Judge it by the method. Sentaro wrote this page and ranks its own product first, and says so above. The weights favor cost and no-IT operation because that is what most nonprofits lack; on training, encryption, backup and certifications Sentaro scores 2 out of 10, near the bottom. Every competitor score cites the vendor page it came from, so you can check any number.
Sources and method
Sentaro publishes this list and ranks itself first; scores use the method above and public vendor documentation as of 21 October 2026. Product capabilities, prices and nonprofit programmes change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.
- Sentaro pricing
- Sentaro: platform (API deployment, Vord engine, vectors)
- Sentaro: customers (logo list)
- Sentaro Data Processing Agreement and subprocessor list
- UK Department for Science, Innovation and Technology: Cyber security breaches survey 2025/2026 (30 April 2026)
- Regulation (EU) 2016/679 (GDPR), EUR-Lex
- Google for Nonprofits: Google Workspace editions and prices (accessed 2026-10-21)
- Google Workspace Admin Help: Advanced phishing and malware protection
- Google Workspace Admin Help: Data regions (accessed 2026-10-18)
- TechImpact: Changes to Microsoft’s Business Premium grant announced (15 May 2025)
- Microsoft Learn: Why do I need Microsoft Defender for Office 365? (accessed 2026-10-18)
- Microsoft: Defender for Office 365 pricing (accessed 2026-10-18)
- Material Security: Pricing (accessed 2026-10-18)
- Material Security: home page (products, setup quote) (accessed 2026-10-18)
- Sublime Security docs: Installation (accessed 2026-10-18)
- GitHub: sublime-security/sublime-rules detection rules
- Check Point: Harmony Email & Collaboration (accessed 2026-10-18)
- Check Point: Harmony Email & Collaboration pricing tiers (accessed 2026-10-18)
- Check Point: Harmony Email & Collaboration admin guide, data residency
- IRONSCALES: Home page (accessed 2026-10-18)
- IRONSCALES: Pricing (accessed 2026-10-18)
- Barracuda: Email Protection (accessed 2026-10-18)
- Barracuda: Email Protection plans (accessed 2026-10-18)
- Guardz: Email Security (accessed 2026-10-21)
- Guardz: Pricing (accessed 2026-10-21)
- Iron Cove Solutions (reseller): Proofpoint Essentials pricing 2026, 1–25 users (accessed 2026-10-21)
- Proofpoint: Core Email Protection (accessed 2026-10-18)
- Material Security: Subprocessors (updated 12 June 2025; accessed 2026-10-21)
- Sublime Security docs: Sublime Cloud regions (accessed 2026-10-21)
- IRONSCALES: List of current sub-processors (PDF, December 2024; accessed 2026-10-21)
- Barracuda Trust Center: Data center locations (accessed 2026-10-21)
- Proofpoint: Third-party service providers and subprocessors (updated 14 October 2026; accessed 2026-10-21)