Volunteer and personal devices: a simple security policy for non-profits

A simple personal device policy for volunteers and staff comes down to a handful of rules: lock the device, keep it updated, turn on multi-factor authentication, keep organization data off the device, and report a lost phone within 24 hours. This guide gives you seven rules you can adapt, an offboarding checklist and tips for introducing the policy without friction. It's general guidance, not legal advice.

Key takeaways

• A single unsecured phone can open a direct path into your organization's email, donor and member data.
• Seven plain-language rules cover most of the risk from personal devices.
• Offboarding matters as much as onboarding: remove access the day a volunteer leaves.
• Introduce the policy during onboarding and frame it as protection for donors and volunteers alike.

Why do volunteer devices need a policy?

Volunteers' and staff's own phones and laptops often carry organization email, donor lists and member information, without the safeguards a managed computer has. Without clear rules, sensitive data can end up in personal cloud accounts or unapproved apps, and a lost phone can expose everything on it.

A BYOD (bring your own device) policy protects against three main risks:

1. Data leakage. Personal devices lack the controls that stop donor records and financial information from being saved to personal cloud accounts or shared through unapproved apps.
2. Phishing and malware. Volunteers checking organization email on their phones face the same phishing attacks as staff. CORE's Email Security filters organization email before it reaches the inbox, on any device.
3. Lost or stolen devices. A phone left in a coffee shop can expose every account and file on it if it isn't locked.

How does a policy strengthen volunteer device security?

Volunteer device security starts with written expectations. A short policy tells volunteers what they must do when using personal tech for your organization: acceptable use, basic security steps and what to do if a device goes missing. We help organizations across Alberta and Canada put these basics in place as part of our work with non-profits.

What are the 7 rules for personal devices?

These seven rules form the backbone of a workable personal device policy. Each one addresses a specific risk.

1. Set a screen lock. Every device that accesses organization email or files needs a PIN, password or fingerprint/face lock.
2. Keep the device updated. Install operating system and app updates promptly. Outdated software has known weaknesses attackers use.
3. Turn on multi-factor authentication. Use multi-factor authentication (a second proof, like an app code) on every organization account. It stops most account takeovers even when a password leaks.
4. Don't save organization data on the device. Keep files in your organization's cloud tools rather than downloading them to personal storage.
5. Use only approved apps. Access organization data through a short list of approved tools. Personal apps with weak security create unnecessary exposure.
6. Report a lost or stolen device within 24 hours. Quick reporting means whoever manages your accounts can reset passwords and sign the device out.
7. Remove access when volunteering ends. When someone leaves, their access goes too. A former volunteer with lingering access is a live risk.

Where does WILDCARD fit in?

Written rules work best alongside protection that runs in the background. CORE's Email Security filters organization email on any device, and Identity Monitor watches your identity, website, domain and the dark web for threats 24/7, which helps catch leaked passwords early. CORE costs $23 per user + $26 per device = $49 per seat per month, before applicable taxes. Device management, remote wipe and incident response through our managed SOC are services for fully managed clients.

How do you write the policy simply?

A practical policy doesn't need to be long. It needs to be understood. Skip the legal jargon and focus on what volunteers actually need to know.

What belongs in the first draft?

1. Which devices are allowed.
2. What organization data can be accessed from personal phones or laptops.
3. The minimum security steps (the seven rules above).
4. What happens when a device is lost or a volunteer leaves.
5. Who to contact with questions.

Keep each point to one concrete action. That keeps the document short enough that people actually read it.

What happens when a volunteer leaves?

A departure creates a security gap if personal devices still hold organization data or signed-in accounts. A simple offboarding checklist closes it.

What should a volunteer offboarding checklist include?

1. Remove access to email, cloud storage and shared apps on the volunteer's last day.
2. Ask the volunteer to delete any organization files on their device, and sign them out of organization apps.
3. Collect any printed materials, keys, badges or organization-owned equipment.
4. Change any shared passwords they knew.
5. Keep a simple record of what was done and when.

For fully managed clients, we can sign devices out and remove organization data remotely as part of our service.

How do you introduce the policy without friction?

A personal device policy succeeds when volunteers see it as support, not surveillance. Start with what they care about: their personal phones and laptops stay personal. The policy only covers how organization data is protected on them. Introduce it during onboarding, not as a surprise email weeks later.

What should we say in the first conversation?

1. Explain the purpose in one sentence: this policy protects donor information and volunteer privacy.
2. Show the scope clearly: which devices are covered and what's expected.
3. Walk through the seven rules and help people turn on screen locks and multi-factor authentication on the spot.
4. Tell them who to call if a device goes missing.

For fully managed clients, security awareness training can help volunteers understand expectations without guesswork.

How do we keep the tone welcoming?

Keep the language plain and the requirements reasonable. Good protection doesn't need heavy bureaucracy. Volunteers who understand the why behind each rule follow it more consistently, and that consistency protects your organization without straining goodwill. That's what we mean by Make IT Disappear: the protection works quietly so your people can focus on the mission.

FAQ

What does a BYOD policy protect against?

Data leakage, phishing and malware, and lost or stolen devices.

Do volunteers have to give up control of their personal phones?

No. The policy only covers how organization data and accounts are protected on the device; personal content stays personal.

What should happen when a volunteer reports a lost phone?

Whoever manages your accounts should reset the volunteer's passwords and sign the device out of organization apps. That's why the policy asks for a report within 24 hours.

Conclusion

A simple personal device policy turns one of your biggest volunteer risks into a manageable one. Define allowed devices, set the seven rules, build offboarding in from day one and introduce the policy warmly during onboarding.

See where your organization stands with the free Domain Security Scan, or call us at 1-888-274-3530 to talk it through.