Why one shared password puts the whole team at risk
In many non-profit offices, one mailbox password gets used by several people because it feels practical. It saves time at first, but it also means nobody can tell who opened a message, changed a calendar entry, or deleted a file. When something goes wrong, the trail is gone and the whole account has to be treated as a risk.
The problem gets bigger when staff work from different places or use personal phones and laptops. If a password is copied into a notes app, sent over WhatsApp, or written on a sticky note next to the router, it can be exposed in minutes. For organisations handling donor records, beneficiary details or board papers, that is not just untidy, it can become a compliance and trust issue very quickly.
What shared access usually looks like in a small office
We often see the same pattern in offices from Observatory to Bloemfontein. A central inbox is used for fundraising, supplier queries, event notices and committee communication. Three or four people know the password, and over time each person becomes unsure who is still meant to have access. Staff leave, interns move on, and the same login keeps travelling from one phone to another.
That setup can work for a week or two. After that it becomes hard to manage. If an account is used for everything, it is difficult to protect the organisation without interrupting daily work.
- No clear record of who read or sent messages
- No easy way to remove access when someone leaves
- Higher chance of accidental deletion or missed replies
- More risk if a phone is lost, stolen or not locked properly
Safer ways to share work without sharing passwords
The better option is to separate the account from the people using it. Instead of giving everyone the same login, set up individual mailboxes and shared folders, then assign access rights based on role. That way staff can work together without all standing in the same doorway.
Shared calendars and document spaces help even more. A project coordinator can manage event dates, a finance officer can keep records in one place, and a volunteer manager can add contacts without needing the same password as the whole team. If someone changes role or leaves, their access can be adjusted without disturbing everyone else.
- Use role-based access instead of one common login
- Keep board, finance and general office access separate
- Turn on account recovery and recovery contacts for admins
- Review permissions after every staff change or new project
A Cape Town example from a busy non-profit office
A small support organisation in Cape Town was using one shared inbox for donor replies, volunteer sign-ups and meeting notices. The team was based partly in Observatory and partly working from home, and messages were sometimes missed because everyone assumed someone else had handled them. When a former contractor still had access, nobody noticed for several weeks. It was not a dramatic incident, just the kind of slow risk that grows when no one owns the account.
The fix was simple. The group moved to separate staff accounts, set up a shared calendar for outreach work, and created a document space for reports and templates. They also removed old access, imported contacts properly, and trained the team on who should use what. Message handling improved, and the admin burden dropped. It was not fancy, but it made the office easier to run, especially on days when load-shedding interrupted normal routines.
What to do before a password becomes a problem
Non-profits do not need complicated systems to improve security. They need clear rules and a clean handover process. Start with the accounts that matter most, then work through the rest of the team. A proper review usually takes less time than people expect and saves hours later on.
If your organisation is still relying on shared passwords, use this checklist to get control back:
- List every mailbox, calendar and document space currently in use
- Identify which accounts are shared and who really needs access
- Remove old users, interns and contractors who no longer need login details
- Create individual accounts for staff where possible
- Set up shared tools for calendars and files instead of passing passwords around
- Train the team on safe use of phones, laptops and password resets
How Inbox NPO Mail helps non-profits keep control
Inbox NPO Mail works with non-profit organisations across South Africa, including Cape Town, Johannesburg, Durban, Pretoria and Bloemfontein. The focus is on practical message, shared calendars and document collaboration that suit small teams and stretched budgets. That includes domain linking, mailbox setup, calendar setup, document space setup, mail migration, contact imports, mobile device setup, admin handover, security review, team training, go live support and ongoing admin help.
For many organisations, the hardest part is not the technology, its the handover. A password that has been shared for years cannot be untangled in one step. We help teams move to cleaner access, keep their contacts and calendars in order, and make sure admin responsibilities are clear. That matters whether your office is in Bellville, Stellenbosch or downtown Pretoria.
Shared passwords may feel easier, but they usually cost more in the long run through lost time, confusion and avoidable risk. For a non-profit, that is money and energy better spent elsewhere.
