Best email security for nonprofits and foundations on Microsoft 365 and Google Workspace: Sentaro. Nonprofits are attacked like any organization that moves money, but with fewer defenders. In the UK Cyber Security Breaches Survey 2025/2026, phishing is by far the most common attack charities report, and the payment fraud that follows is quiet: a fake request from the director, a changed bank account for a grant recipient or supplier, a donor “refund” that never should have been paid. Sentaro handles these automatically so a small team is not reviewing every alert.
- Why Sentaro wins
- Protection that works without rules to maintain or a security person on staff. Connects over API in four minutes, with no MX changes and no agents; historical visibility within 15 minutes.
- What Microsoft and Google already cover
- Microsoft documents built-in anti-malware, anti-spam and anti-spoofing for every cloud mailbox, and impersonation protection and Safe Links in Defender for Office 365 Plan 1. Google documents spoofing, link and attachment protections in Gmail. Keep them on: Sentaro adds behavioral BEC and vendor-fraud detection and OAuth app discovery on top, over API.
- Cost
- $6 per protected account per month, or $68 per account per year; the first account is free. Shared aliases and distribution lists do not count. Prices in USD.
- In production
- Childhood and the Tim Bergling Foundation are on Sentaro’s customer roster.
- Keep doing
- Phone verification of every bank-detail change and two signatures on outgoing payments. Software does not replace them.
At a glance
- Built for
- Foundations, charities, NGOs, associations and fundraising organizations on Google Workspace or Microsoft 365
- Threats covered today
- Director and board impersonation, grant and supplier bank-detail fraud, credential phishing, QR-code lures, consent phishing, unapproved AI tools
- Status
- Message and App vectors are live. Roadmap items are listed once, in the roadmap note on this page.
- Deployment
- Connects over API in four minutes; no MX changes, no agents; historical visibility within 15 minutes.
- Pricing
- $6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD. Free plan coming soon.
- In production at
- Childhood and the Tim Bergling Foundation
How common are cyber attacks on charities?
The best public data on charities comes from the UK government’s Cyber Security Breaches Survey 2025/2026, published on 30 April 2026. Phishing was the most prevalent type of breach or attack by far, experienced by 25% of UK charities, and was named the most disruptive type by 69% of businesses and charities that had a breach or attack. Among affected charities, the share that experienced phishing and nothing else rose from 46% to 57% in a year.
The same survey shows how thin defenses are: only 17% of charities ran staff training or awareness activities in the past year, down from 21%, with the drop driven by low-income charities, and 30% had board-level responsibility for cyber security. Comparable EU-wide figures for nonprofits are not published; the UK numbers are the closest primary source.
Workflows that attackers exploit in a nonprofit
| Workflow | How it is attacked (typical case) | What Sentaro checks (live) |
|---|---|---|
| Grants to partner organizations | A partner “confirms” a new bank account before a disbursement, inside a real thread | Sudden banking-detail changes, injected replies, reply-chain reuse |
| Director and board requests | The secretary general “needs” an urgent, confidential transfer while travelling | Display-name mismatch, sender infrastructure, the urgent-confidential pattern in any language |
| Donor relations | A “major donor” asks for a refund of a gift to a new account, or a fake donor sends a malicious “receipt” | Payment-redirect intent; link, attachment and QR destination analysis |
| Events and campaigns | Fake suppliers, venues and ticketing platforms invoice during a campaign rush | Newly registered lookalike domains at first contact |
| Volunteers and shared tools | Many people sign in to Google Workspace or Microsoft 365 and connect apps | Credential phishing; OAuth and AI-tool inventory with one-click revocation |
What data protection rules apply to a nonprofit’s email?
Nonprofits are generally not in scope of NIS2, which is limited to listed sectors, unless they operate in one, such as health or research. GDPR applies in full. Many nonprofits process special categories of personal data under Article 9: health information about beneficiaries, or data revealing political, philosophical or religious beliefs or trade-union membership. Article 9(2)(d) lets foundations and associations with such aims process those data about members and regular contacts, with appropriate safeguards and without disclosure outside the body without consent. GDPR recital 38 adds that children merit specific protection.
| Obligation | What it means for email | How Sentaro supports it | Evidence produced |
|---|---|---|---|
| GDPR Art. 32: security appropriate to the risk | Mailboxes hold donor, beneficiary and sometimes children’s data | Phishing and impersonation detected before interaction; risky app grants revocable in one click | Verdicts with reasoning; app and grant inventory |
| GDPR Art. 33: breach notification within 72 hours of awareness | A taken-over mailbox may be a reportable personal data breach | Earlier detection, including internal mail from a compromised account | Who was targeted, what was delivered or blocked, when, and the spread |
| Funder and donor expectations on financial controls | Grant agreements and audits expect money to reach the intended recipient | Payment-redirect and vendor-compromise detection in grant and supplier threads | Admin console, audit trail and reporting |
No product makes an organization GDPR compliant. This is general guidance, not legal advice.
Board impersonation, grant payments and donor data: what Sentaro covers
Status as published by Sentaro on 18 October 2026.
| Capability | Sentaro | Vector |
|---|---|---|
| Live today | ||
| Director or board impersonation asking for money | YesPayload-free intent analysis | Message |
| Changed bank details for a grant recipient or supplier | YesVendor-compromise and thread-hijack detection | Message |
| Credential phishing and QR-code lures | YesDestination analysis, not reputation lookups alone | Message |
| Apps and AI tools staff connect on their own | YesDiscovered automatically; legitimate tools are not blocked | App |
| Outside Sentaro | ||
| Scam emails sent to your donors in your name | NoDonors’ inboxes are not in your tenant | — |
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
Charities and phishing, in numbers
Organizations running Sentaro
In production at Alice Labs, Bang Agency, Buteo Services, Childhood, Croisette, Entire, Eventeffect, GRXWTH, Mantle, Pace Agency, Signific, Sweetspot, Tim Bergling Foundation.
Sovereignty and procurement facts
What a board, an auditor or a data protection officer may ask before you connect your tenant.
- Hosting
- Hosted in Sweden on Microsoft Azure. EU-sovereign by design.
- Subprocessors
- Listed in Annex 3 of the DPA, with locations in the EU, the US and globally, including a US AI provider used for limited threat-signal analysis with no training on customer data. Review the list at /en/legal/dpa.
- Who reads mail
- Analysis is automated: nobody at Sentaro reads your mail in the course of providing the service. The DPA sets out the narrow exceptions.
- Incident notice to you
- Without undue delay and in any event within 24 hours of confirming a security incident (DPA).
- Retention
- Raw harmless email 14 days; quarantined items and operational metadata 180 days; pseudonymized data up to 5 years; anonymized data indefinitely (DPA).
- Exit
- Return or deletion of customer data within 30 days of termination, with certification on request (DPA).
- Audit
- Customer audit through an independent third party, at most once per 12 months. Swedish law; SCCs for transfers.
- Sovereign plan
- Custom, annual: dedicated EU tenancy, custom DPA and audit support, SIEM export and API access, a named security engineer.
Getting started without an IT department
- 01
Start with one account
The first protected account is free. Connect the mailbox of the person who handles payments.
- 02
Connect the whole tenant
A Google Workspace or Microsoft 365 admin connects over API in about four minutes. No mail rerouting, nothing to install on laptops.
- 03
Let it run
Malicious messages are removed or quarantined automatically, and verdicts are labeled in the mailbox. Alerts fire only when someone needs to decide.
- 04
Review connected apps once
Check the app and AI-tool inventory and revoke anything you do not recognize.
Frequently asked questions
What is the best email security for nonprofits?
Sentaro — it is our pick for nonprofits and foundations on Google Workspace or Microsoft 365 without a security team. It catches phishing, director impersonation and changed bank details for grant recipients or suppliers automatically, and alerts only when a decision is needed. It connects over API in four minutes and costs $6 per protected account per month, or $68 per account per year, with the first account free and shared aliases not counted (prices in USD).
What is the biggest cyber risk for a small charity?
Phishing. In the UK government’s Cyber Security Breaches Survey 2025/2026, phishing was by far the most common breach or attack against charities, reported by 25% of them. The version that moves money is payment fraud: a fake request from the director or a changed bank account for a supplier or grant recipient. Phone verification of payment changes and automatic email detection together close the main routes.
Does NIS2 apply to nonprofits?
Usually not. NIS2 applies to medium-sized and larger entities in listed sectors such as energy, health, transport and research. A nonprofit that runs a hospital, a research organization or another listed activity may be in scope for that activity. GDPR applies to every nonprofit that processes personal data.
Do we need a security person to run Sentaro?
No. Verdicts are automatic and remediation is a click. Malicious messages are removed or quarantined automatically, and alerts fire when a decision is needed rather than for every blocked message. An admin connects the tenant once, in about four minutes.
How much does Sentaro cost for a nonprofit?
Pro costs $6 per protected account per month, or $68 per account per year, and the first account is free. Only mailboxes Sentaro watches count; shared aliases and distribution lists do not. Sentaro does not publish a separate nonprofit discount. Prices in USD, exclusive of taxes. A Free plan for one person is coming soon.
Can Sentaro stop scammers emailing our donors in our name?
Not directly, because those emails go to donors’ own inboxes. Sentaro protects your organization’s tenant. Alerts when lookalikes of your domain are registered are part of the Identity vector, scheduled for Q4 2026. Until then, tell donors how you will and will not ask for money, and publish your genuine payment details on your website.
Which nonprofits use Sentaro?
Sentaro’s customer list includes foundations such as Childhood and the Tim Bergling Foundation. Sentaro does not publish a nonprofit case study, and no customer count is published.
Sources and method
- UK Department for Science, Innovation and Technology: Cyber security breaches survey 2025/2026 (30 April 2026)
- Regulation (EU) 2016/679 (GDPR), EUR-Lex
- Directive (EU) 2022/2555 (NIS2), EUR-Lex
- FBI IC3 Internet Crime Report 2025
- Microsoft Learn: Built-in security features for all cloud mailboxes (EOP)
- Microsoft Learn: Why do I need Microsoft Defender for Office 365?
- Google Workspace Admin Help: Advanced phishing and malware protection
- Sentaro Data Processing Agreement (subprocessors, retention, incident notice)