Before you accept donated or discounted software, ask where your data will live, who can access it, how it is updated, what happens when the donation ends, and whether you can leave with your data. Free does not mean low risk. It often means you take on the same duties with less support.
Why donated software needs a check
A donation arrives with enthusiasm and a deadline. A staff member wants it live next week. The questions that protect you are easy to skip because nobody is invoicing you.
The risks are practical: the product is dropped in a year and your records are stuck, the license changes, or the free tier lacks the security features you need.
The checklist
Data
- Where is data stored, and in which country?
- Is data encrypted in transit and at rest? Ask the vendor to state it in writing.
- Can we export everything in a common format?
- Can we delete all data on request?
Access
- Can each person have their own login?
- Is MFA supported on the plan we get?
- Can we set roles so volunteers see only what they need?
- Is there an activity log we can read?
Updates and support
- How are security fixes delivered?
- Who do we contact about a problem?
- How long is the donation valid, and what happens next?
Exit
- If the terms change, what is our plan B?
- Who owns the account, the organization or an individual?
Score the answers
| Answer | Reading |
|---|---|
| Clear and in writing | Good sign |
| Vague or "we will check" | Ask again before you load real data |
| Refused | Do not store sensitive data there |
If a question has no answer, start with test data only, never real donor or client records.
Watch the plan, not only the product
Security features often differ between a donated tier and a paid one. Confirm that MFA, audit logs and export are on the exact plan you receive. Do not assume the marketing page describes your tier.
Ownership of the account
Make sure the account is registered to an organizational address, not a volunteer's personal email. When that person leaves, you could lose the system. Record the owner in your list of accounts. For related guidance, see our questions to ask about a volunteer built website or app.
When the software is a code library or tool
If the donated item is code or a developer tool, check its dependencies and known advisories before deploying. Safeguard's free scan at gold.safeguard.sh/scan can list dependencies and known issues for a manifest you provide.
Keep a record of the decision
Write two lines in your account list: why you accepted the offer and what you checked. When staff change, the next person will know what was agreed, who owns the account and when the donation is reviewed. It also helps if a funder later asks how you choose tools.
Quick check
Is accepting free software ever a bad idea?
Yes, if you cannot get your data out, cannot enforce MFA or cannot learn who else can access the records. In those cases decline or limit use to non sensitive data.
Who should approve the donation?
Someone who can say yes for data protection, not only for budget. In a small group that may be the director plus one trusted volunteer.
Last reviewed: 19 October 2026.
