Your AI Toolkit: Safe Tools & Setup

Why This Module Exists

Most non-profits already use AI — they just don't manage it. Staff quietly paste a grant report into a free chatbot, drop a donor list into a "summarize this" tool, or sign up for whatever was free that week. None of it is malicious. It is people trying to get the work done with the tools in front of them. But "whatever's free, signed up under a personal Gmail" is exactly how beneficiary data ends up training someone else's model, and how a lean team ends up with twelve tools, zero owners, and no idea which ones touch sensitive data.

This pattern has a name now: shadow AI — unsanctioned AI tools used without any review. Industry surveys in 2025 put unauthorized AI use very high (one widely cited IDC figure: ~56% of employees use unapproved AI tools, while only ~23% use tools their organization provides and governs — directional). For a non-profit, the stakes are not abstract: the data at risk is often about people experiencing poverty, displacement, trauma, or illness.

The good news is that the safer path is usually the cheaper path. The major vendors now give non-profits enterprise-grade AI at free or steep-discount rates — the same tiers that contractually promise not to train on your data. The job of this module is not to lock staff down. It is to make the safe tool the easy, obvious, already-set-up tool — and to give the org one lightweight way to evaluate the next one.

Learning Objectives

By the end of this module, participants will be able to:

1. Explain, in plain language, the difference between a consumer AI tier and an enterprise/managed tier — and why "no training on your data," admin controls, and SSO matter.
2. Read and use the organization's approved-tool catalog: which tool is allowed for which class of data, and who owns it.
3. Match an AI task to the right tool using the org's data classification (public / internal / sensitive-beneficiary-or-donor).
4. Claim and set up the major nonprofit AI offers (Microsoft, Google, TechSoup, plus ChatGPT/Claude tiers) and know what each free/discounted offer actually includes.
5. Apply the baseline security hygiene checklist — MFA, backups, phishing awareness, access controls — and explain why these matter more once AI is in the building.
6. Describe what API / export capability means in plain terms, and check whether the org's current systems have it.
7. Submit and triage a new-tool request through a fast, lightweight approval process.
8. Name the sector resources (TechSoup, NTEN, NetHope, Microsoft/Google nonprofit programs) the org can lean on instead of paying consultants.

Session Agenda

Core Content

Part 1 — Consumer vs. Enterprise/Managed Tiers (the one distinction that matters most)

Every major AI tool comes in two broad flavors. They can look almost identical on screen. The difference is in the contract and the controls behind them.

Consumer tier (free or cheap personal plans — e.g., free ChatGPT, the Gemini app on a personal account, Claude Free/Pro on a personal login):

• By default the vendor may use your conversations to train its models. On free ChatGPT, for example, chats may be used for training unless you manually opt out (directional, per OpenAI's stated policy).
• No central admin. If a staff member leaves, no one can see or revoke their account.
• No organization-wide data-processing agreement, no audit trail, no single sign-on.

Enterprise / managed tier (business and nonprofit plans tied to your org's accounts):

• A contractual commitment not to train on your content. This is the headline. Microsoft 365 Copilot Chat's "Enterprise Data Protection" states prompts and responses aren't used to train the foundation models, and aren't shared with or used to train OpenAI's models. OpenAI's Business/Enterprise and Anthropic's Claude Team/Enterprise tiers carry the same no-training-by-default commitment.
• Admin controls + SSO (single sign-on): IT can provision and de-provision accounts, enforce login through your existing identity, and offboard a departing staff member in one place — which matters enormously in a high-turnover sector.
• Audit + retention controls: visibility into use and the ability to set how long data is kept.

   CONSUMER TIER                         ENTERPRISE / MANAGED TIER
   ┌───────────────────────┐             ┌───────────────────────────┐
   │ personal login        │             │ org account + SSO         │
   │ may train on your data │   ──vs──▶   │ contractual: NO training  │
   │ no admin / no offboard │             │ admin controls, audit     │
   │ fine for PUBLIC data   │             │ ok for INTERNAL data;     │
   │ only                   │             │ sensitive only if vetted  │
   └───────────────────────┘             └───────────────────────────┘

Do / Don't

• ✅ Do route everyone to the org's managed tier for anything beyond public information.
• ✅ Do confirm the no-training term in writing for each approved tool.
• ❌ Don't let staff use personal AI logins for work.
• ❌ Don't assume "paid" means "safe" — the Plus/Pro personal plans usually have the same data relationship as free.

How to actually verify "no training on our data" (a 4-step check the owner runs before a tool goes in the catalog):

1. Find the tier's terms / trust page (search: "<tool> business data not used for training")
2. Confirm it says NO training BY DEFAULT — not "you can opt out" (opt-out = consumer signal)
3. Confirm there's an admin console (you can add/remove users) and SSO support
4. Confirm a Data Processing Agreement (DPA) is available — required before sensitive data

If you can't tick all four, the tool is Public-data-only until you can.

Part 2 — The Nonprofit Offers (free and discounted, claim them now)

You almost certainly qualify for enterprise-grade AI at little or no cost. Eligibility generally requires recognized nonprofit/charity status (501(c)(3) equivalent). Here is what's on the table as of mid-2026 (pricing and inclusions change — verify at the source links before budgeting):

• Microsoft for Nonprofits. Discounted/granted Microsoft 365. Microsoft 365 Copilot Chat is included free with nonprofit M365 plans and carries Enterprise Data Protection automatically (look for the green shield). The full Microsoft 365 Copilot add-on (the one embedded in Word/Excel/Outlook/Teams) is discounted ~15% for nonprofits — about $25.50/user/month billed yearly vs. ~$36 commercial (directional) — and requires an underlying M365 license.
• Google for Nonprofits. Google Workspace for Nonprofits is free for up to ~2,000 users and now includes the Gemini app, NotebookLM, and 10+ AI features with enterprise security and data protections. Paid upgrades for advanced Gemini are discounted up to ~75% (starting around $3.50/user/month, directional), managed in the Workspace Admin console.
• TechSoup. A free account gives access to donated/discounted software and services from 100+ partners (Microsoft, Adobe, Zoom, Dropbox, Intuit, AWS, and AI tools such as Otter.ai and Notion AI at nonprofit rates) — discounts commonly cited up to ~90% (directional). TechSoup is also the validation path many vendors use to confirm your nonprofit status.
• ChatGPT (OpenAI). Free/Plus are consumer tiers; Business and Enterprise carry the no-training-on-your-data commitment and admin controls. No broad public nonprofit discount as standard — negotiate or access vetted AI tools via TechSoup.
• Claude (Anthropic). Team and Enterprise include a contractual no-model-training commitment and admin features; consumer Pro does not provide a data-processing agreement. Anthropic also sponsors the NTEN nonprofit AI cohort (a capability resource, separate from licensing).

A "good starter stack" most lean orgs can stand up this month (all free or near-free):

1. Managed assistant  → M365 Copilot Chat  OR  Google Gemini in Workspace for Nonprofits
2. Identity + MFA      → the same Microsoft/Google account, MFA enforced
3. Validation + extras → a free TechSoup account for discounted add-ons (transcription, etc.)
4. The two artifacts   → the approved-tool catalog + the new-tool intake form

Notice what's not on the list: a separate paid chatbot, a custom build, or a consultant. You add those only when the catalog and a real task justify them — which is also the story Module 5 helps you tell a funder.

Part 3 — The Approved-Tool Catalog (the heart of this module)

The catalog is one short living table that answers three questions for every tool: What is it allowed to touch? Is it the safe tier? Who owns it? It turns "is this OK?" from a debate into a lookup.

It depends on your data classes from Module 2. Use three simple classes:

PUBLIC            → already on your website / press release; no harm if seen
INTERNAL          → org operations: drafts, budgets, internal memos; not for public
SENSITIVE         → beneficiary or donor personal data; the people you serve
                    cannot absorb a leak — highest protection

The rule of thumb that staff can memorize:

PUBLIC      → any approved tool is fine
INTERNAL    → managed/enterprise tier only
SENSITIVE   → managed tier AND explicitly vetted for that data class,
              with a data-processing agreement — when in doubt, don't

(The starter catalog table is in Templates & Takeaway Artifacts below — you'll fill it in during the session.)

Do / Don't

• ✅ Do keep the catalog to one page; long policies don't get read.
• ✅ Do name a single owner per tool (license, renewal, who to ask).
• ❌ Don't list a tool you haven't confirmed the data-training terms for.
• ❌ Don't let the catalog go stale — review it at the 90-day mark and each grant cycle.

Part 4 — Baseline Security Hygiene (this matters more with AI)

AI raises the value of your accounts: an assistant connected to your email and files is a bigger prize for an attacker, and a phished login now exposes more. Non-profits are already prime targets — email attacks on nonprofits rose ~35% in a recent year, and most breaches start with a phished credential (directional; sources below). Four basics block the overwhelming majority of attacks. None require a big budget.

1. MFA (multi-factor authentication) — the single highest-value control. Requires a second factor (app code or key) beyond a password. Microsoft and others report MFA blocks >99% of automated account-compromise attempts (directional). Turn it on for all email, finance, admin, and AI/cloud accounts. Prefer an authenticator app over SMS.
2. Backups — and test a restore. Keep recent backups of your core data, ideally with one copy offline/separate (the "3-2-1" idea: 3 copies, 2 media, 1 off-site). The only proof a backup works is restoring a small file from it. This is your ransomware insurance.
3. Phishing awareness. Most intrusions start with a convincing email. Teach staff to slow down on urgency, hover links, verify money/data requests on a second channel, and report suspicious mail without blame. Note: AI now makes phishing emails cleaner and more personalized — "bad grammar" is no longer a reliable tell.
4. Access controls (least privilege) + device basics. People get access to only what their role needs; shared logins are eliminated; accounts are removed the day someone leaves (high turnover makes this critical). Keep devices updated and screen-locked.

   PASSWORD ALONE         ──────────▶   easily phished / reused / leaked
   PASSWORD + MFA         ──────────▶   blocks >99% of automated attacks
   + tested BACKUPS       ──────────▶   you survive ransomware
   + PHISHING-AWARE STAFF ──────────▶   you stop the #1 entry point
   + LEAST PRIVILEGE      ──────────▶   one breach ≠ everything breached

Part 5 — API / Export & Integration, in Plain Language

You don't need to be technical to make good integration decisions. Two plain ideas:

• Export = can you get your data out in a usable file (CSV/Excel)? If yes, you're never trapped, and you can move data to where it's useful. Check this for every system before you adopt it.
• API (application programming interface) = a doorway that lets two systems talk automatically, so data flows without manual copy-paste. Tools like Zapier connect common nonprofit apps (e.g., a donation form to Salesforce) using these doorways.

Why it matters for AI: integration is what turns AI from a clever toy into time saved — but every new connection is also a new place data can flow, so it must respect the same data-class rules.

A quick way to check any tool you already use:

Settings / Account  →  look for "Export," "Download data," or "API / Integrations"
   Has CSV/Excel export?      → good, you're not locked in
   Has an API / Zapier app?   → automation is possible (review it like a new tool)
   Has neither?               → flag it; manual copy-paste is your only path, and
                                that's where sensitive data gets pasted into the wrong place

Do / Don't

• ✅ Do prefer tools with clean export — it protects you against lock-in and dead grants.
• ✅ Do treat each integration as a data flow that needs the same approval as a new tool.
• ❌ Don't wire sensitive data into an automation just because the connector exists.

Part 6 — The New-Tool Request Process (fast on purpose)

If approval takes a month, staff will route around it — that's how shadow AI is born. The goal is a process that says "yes" to low-risk tools in days, and asks harder questions only when sensitive data or money is involved. A practical three-tier triage (adapted from common 2025 governance guidance):

TIER A — fast-track (decide in ~2 days)
   Managed-tier tool · PUBLIC or INTERNAL data only · no sensitive data, no payments
   → Owner + one reviewer approve; add to catalog.

TIER B — standard review (~1–2 weeks)
   Touches SENSITIVE data OR connects to a core system OR has a cost
   → Confirm no-training terms, data-processing agreement, MFA/admin support,
     export capability; ED or data lead sign-off.

TIER C — escalate
   AI influencing beneficiary eligibility/decisions, crisis comms, or health/legal data
   → Goes to leadership + Module 7 safeguards review; often the answer is "not yet."

The intake form (in Templates below) is deliberately five questions. The reviewer's job is to slot it into A/B/C and respond fast.

Hands-On Exercises

Exercise 1 — Match the Task to the Right Tool (15 min)

For each scenario, decide: which data class, and which tier/tool is appropriate?

1. Draft a public social-media post announcing an event.
2. Summarize an internal staff-meeting transcript.
3. "Clean up" a spreadsheet of beneficiary names, addresses, and case notes.
4. Rewrite a grant report (contains program outcomes, no personal data) more concisely.
5. Triage which beneficiaries qualify for an emergency-rent program.

Facilitator answer key:

1. PUBLIC → any approved tool, including the managed assistant. ✅
2. INTERNAL → managed/enterprise tier only (no-training). ✅
3. SENSITIVE → stop. Not in a general tool. Requires a tool explicitly vetted for sensitive data with an agreement; default answer today is "no." 🚫
4. INTERNAL → managed tier; human reviews output before it goes to the funder (Diligence). ✅
5. SENSITIVE + high-stakes beneficiary decision → Tier C / Module 7. AI does not decide eligibility; at most it organizes information for a human decision, with consent and review. 🚫 as described.

Exercise 2 — Turn MFA On (15 min, hands-on)

Walk participants through enabling MFA via an authenticator app on their primary email/M365 or Google account, live in the room. Confirm each person completes a test login. Answer key / facilitator note: if anyone manages a shared or service account, flag it for the access-controls follow-up (shared logins should be eliminated or vaulted). Success = every attendee leaves with MFA on at least one critical account.

Exercise 3 — Run One Real Request Through (10 min)

Have a staff member submit one tool they actually want using the intake form. As a group, triage it A/B/C and decide. Answer key: the "right" outcome is a clear, fast decision with a named owner — not necessarily approval. If it's Tier B/C, name exactly what's needed to clear it.

Templates & Takeaway Artifacts

Artifact 1 — Approved-Tool Catalog (starter; one page, living)

Artifact 2 — New-Tool Request (intake form)

NEW AI / TECH TOOL REQUEST
1. Tool name + link:
2. What task will it do, and who will use it?
3. What data class will it touch?   [ ] Public  [ ] Internal  [ ] Sensitive (beneficiary/donor)
4. Is there a managed/enterprise tier with "no training on our data"?  [ ] Yes  [ ] No  [ ] Unsure
5. Cost? Does it connect to (integrate with) any of our systems?  [ ] No cost  [ ] Cost: ____  [ ] Integrates with: ____

— Reviewer use —
Triage:  [ ] A fast-track   [ ] B standard review   [ ] C escalate (sensitive/high-stakes → Module 7)
Decision + date:                         Owner if approved:
Conditions to clear (B/C):

Artifact 3 — Baseline Security Hygiene Checklist (one page, print it)

□ MFA is ON for ALL email, finance, admin, cloud, and AI accounts (authenticator app, not SMS)
□ No shared logins; each person has their own account
□ Departing-staff offboarding: accounts removed the SAME DAY (named owner: ____)
□ Backups exist for core data; one copy is off-site/offline (3-2-1)
□ A test restore was completed in the last 90 days (date: ____)
□ Staff have had phishing awareness in the last 12 months; "report suspicious email" path is known
□ Money/data requests are verified on a SECOND channel before action
□ Devices are updated and screen-lock/auto-lock is on
□ Least privilege: people can access only what their role needs
□ MFA confirmed on the accounts BEFORE connecting any AI assistant to email/files
Owners assigned: MFA ___  Backups/restore ___  Phishing training ___  Offboarding ___

Knowledge Check

1. (MCQ) The single most important difference between a consumer and an enterprise/managed AI tier is:
   a) speed  b) a contractual commitment not to train on your data + admin controls  c) the price  d) the logo
2. (MCQ) A staff member wants to summarize an internal budget memo. Which is appropriate?
   a) free personal ChatGPT  b) the org's managed assistant (no-training tier)  c) any tool, it's just a memo  d) no AI ever
3. (Short answer) Why does "paid" not automatically mean "safe" for ChatGPT or Claude?
4. (MCQ) Which control reportedly blocks >99% of automated account-compromise attempts?
   a) antivirus  b) a strong password alone  c) MFA  d) a firewall
5. (Short answer) In one sentence, what is "shadow AI" and why is a fast approval process the best defense?
6. (MCQ) Beneficiary case notes should go into:
   a) whatever's quickest  b) the managed assistant  c) only a tool explicitly vetted for sensitive data with a signed agreement — otherwise no AI  d) a personal account
7. (Short answer) What does "export capability" protect you against?
8. (MCQ) Microsoft 365 Copilot Chat for an eligible nonprofit is:
   a) $36/user/month  b) free with the nonprofit M365 plan, with Enterprise Data Protection  c) consumer-tier  d) unavailable to nonprofits

Answer key

1-b · 2-b · 3: Plus/Pro personal plans usually carry the same data relationship as free (data may be used/retained); only Business/Enterprise/Team tiers add the no-training commitment and admin controls. · 4-c · 5: Shadow AI = unsanctioned AI tool use with no review; a fast "yes-path" for low-risk tools removes the incentive to route around IT. · 6-c · 7: Vendor lock-in and being stranded when a grant/tool ends — you can always take your data with you. · 8-b.

Facilitator Guide

Prep checklist

• Confirm the org's data classes from Module 2 are defined; if not, define the three classes (public/internal/sensitive) first — the catalog depends on it.
• Have admin access ready to demo claiming the Microsoft and/or Google nonprofit offer, or have screenshots if not yet provisioned.
• Pre-create a blank approved-tool catalog and intake form in a shared doc.
• Print the security hygiene checklist for every attendee.

Free/low-cost materials needed: a TechSoup account (free), the Microsoft/Google nonprofit offer pages, an authenticator app on phones, NTEN cybersecurity hub and CISA free guidance as references. No paid tooling required to run the session.

Timing: the live MFA exercise (Part 4) always runs long — protect it; it's the highest-value 15 minutes in the room.

Common pitfalls

• Treating this as "lock everything down." Reframe: we're making the safe tool the easy tool.
• Naming a tool nobody owns. Every catalog row gets an owner before the session ends.
• Skipping the "test restore" — an untested backup is a guess, not a safeguard.
• Approving by price/name instead of confirming the data-training term.

Discussion prompts

• "What are we already using under personal logins?" (surface shadow AI without blame)
• "What's the one tool people keep asking for? Let's run it through the process now."

Tailoring by audience

• A6 IT/Data lead: lead the catalog, tiers, integration, and approval triage. If IT is outsourced/absent, this module assigns the basics as named human tasks.
• A5 Operations: owns the catalog and intake as a living process; the renewal/owner column is theirs.
• A3 all staff: focus on Parts 1, 4, and 6 — what's allowed, MFA, and how to request a tool. They don't need the integration depth.

Addressing fear/resistance: staff resistance is real. Frame security and approval as protecting the people we serve and the staff personally (MFA protects your own accounts too), and emphasize that the managed tools are usually free upgrades, not restrictions. Celebrate the first staff-requested tool that gets approved fast — it proves the process is an ally, not a gate.

Common objections and the honest response:

Outcome Scorecard

Further Resources & Sources

Sector resources to lean on (free/low-cost):

• TechSoup — discounted/donated software + nonprofit-status validation: https://www.techsoup.org/ ; AI services: https://page.techsoup.org/ai-services-for-nonprofits
• NTEN — Nonprofit Cybersecurity Readiness program + AI resource hub: https://www.nten.org/learn/nonprofit-cybersecurity-readiness ; https://www.nten.org/learn/nonprofit-tech-readiness/ai-for-nonprofits
• NetHope — humanitarian/development cybersecurity + AI governance: https://nethope.org/digital_dimension/cybersecurity/
• CISA — Cross-Sector Cybersecurity Performance Goals (free baseline controls): https://www.cisa.gov/

Vendor nonprofit programs & tiers:

• Microsoft for Nonprofits — offers/eligibility/AI: https://www.microsoft.com/en-us/nonprofits/offers-for-nonprofits ; https://www.microsoft.com/en-us/nonprofits/eligibility
• Microsoft 365 Copilot Chat Enterprise Data Protection (no training on data): https://learn.microsoft.com/en-us/microsoft-365/copilot/enterprise-data-protection
• Google for Nonprofits / Workspace + Gemini: https://workspace.google.com/learning/google-workspace-for-nonprofits-with-gemini ; https://support.google.com/nonprofits/answer/15873832
• OpenAI ChatGPT plans (Business/Enterprise no-training): https://chatgpt.com/pricing/
• Anthropic — is my data used for training (Team/Enterprise): https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training

Risk / governance context (mark stats directional):

• Shadow AI scope (IDC/IBM 2025 figures): https://www.isaca.org/resources/news-and-trends/industry-news/2025/the-rise-of-shadow-ai-auditing-unauthorized-ai-tools-in-the-enterprise ; https://www.cio.com/article/4107318/shedding-light-on-shadow-ai.html
• Nonprofit cybersecurity basics + phishing/MFA stats: https://keystonecorp.com/nonprofits/essential-cybersecurity-practices-every-nonprofit-needs/ ; https://www.brightdefense.com/resources/phishing-statistics/
• TechSoup/Tapp 2025 AI Benchmark (76% lack an AI strategy — directional): https://blog.techsoup.org/posts/what-ai-means-for-nonprofits-in-2025-insights-from-the-ai-benchmark-report