What our security review looks at
We review the parts of your message and collaboration setup that affect day-to-day safety. For many NPOs, the main risk is not a major breach but small gaps such as shared logins, old accounts that were never closed, or staff using personal devices without the right safeguards. Our review looks at those pressure points and flags where access should be tightened.
The check is practical and based on how your organisation actually works. We look at who owns each mailbox, which users have admin rights, whether calendar and document access is limited to the right people, and if your password practices still suit your team size and turnover. If your organisation works from Cape Town, Johannesburg, Durban, Pretoria or Bloemfontein, we can assess the structure remotely and keep the process simple.
- Mailbox ownership and shared account use
- Administrator roles and permission levels
- Password strength and reset practice
- Calendar sharing rules and external access
- Document space access by team or project
- Inactive accounts and leavers review
Access rights, roles and password checks
We start with account roles because that is where many small organisations get caught out. A project coordinator may only need calendar access, while a finance officer may need document access but not full administration rights. We check who can create users, change security settings, view shared folders, and recover accounts. If one person has been given too much control for convenience, we note it and recommend a cleaner setup.
Password practice is checked alongside access rights. We do not just ask whether passwords exist, we look at how they are stored, how often they are changed, and whether staff still reuse old passwords across more than one service. Where two-factor protection or other sign-in controls are in place, we confirm they are being used properly. This helps reduce the chance of unauthorised access from lost phones, weak logins, or staff leaving without a full handover.
- Role mapping for administrators, staff and volunteers
- Review of password reset process and shared credentials
- Check for outdated accounts linked to former staff or volunteers
- Confirmation of sign-in controls on active mailboxes
- Practical recommendations ranked by urgency
How the review is carried out
The process begins with a short briefing so we understand your structure, team size, and any deadlines around funding reports, board meetings, or donor communication. We then review the live setup and compare it with the way your team should operate. If required, we can work around limited availability because many NPOs have busy mornings, field work, or part-time staff coming and going through the week.
After the review, we prepare a clear summary of findings. This includes immediate fixes, medium-term improvements, and any items that should be checked again after staff changes. Where admin access needs to be adjusted, we can assist with the changeover so you do not lose control during the update. The aim is to leave your setup easier to manage and less exposed to avoidable mistakes.
- Initial briefing and scope confirmation
- Access review across mail, calendars and documents
- Risk notes and recommended changes
- Optional implementation support for approved fixes
- Written handover for internal records
Turnaround, pricing approach and what affects the cost
Most security reviews are turned around in a short, agreed window once we have the information we need. Smaller teams can often be reviewed faster, while organisations with multiple offices, several shared mailboxes, or a large document library may need a bit more time. We keep the timeline realistic rather than promising something that cannot be checked properly.
Pricing is based on scope, not on guesswork. We look at the number of users, the amount of shared access, whether migration history needs to be checked, and whether you want us to make changes after the review. That means a small community organisation with ten users will not pay the same as a national NPO with branch access across several provinces. If your team needs help during year-end or before a board changeover, we can quote for a focused review on the areas that matter most.
- Smaller setups can often be completed within a few working days
- Multi-site or high-access environments may take longer
- Quotes are based on number of accounts and systems reviewed
- Implementation work is quoted separately if required
Keeping the setup safe after the first review
A single review is useful, but account risk changes whenever staff join, leave, or move into new duties. We normally recommend a maintenance interval of every six months for active teams, and quarterly checks for organisations with frequent volunteer turnover or several people handling admin. That keeps the account structure aligned with real use, not just with old paperwork.
Between reviews, we can also help with admin handover steps, staff training, and changes to mailbox or calendar access. For organisations working in coastal areas like Cape Town or Durban, we often suggest checking device sign-ins and backup habits as part of the routine because humidity, power cuts and phone replacements can all affect access. A few small checks at the right time often prevent larger problems later.
Secure, practical mail for South African NPOs
Non-profit organisations need security that supports real work. Staff are often busy, budgets are tight, and one person may handle fundraising, scheduling and donor communication at the same time. That makes clear permissions and simple account control very important. Our security review is shaped for that reality, with plain feedback and practical fixes that do not overload your team.
Inbox NPO Mail is based in Observatory, Cape Town and supports organisations across South Africa. Whether your main office is in Johannesburg, your project team is in Pretoria, or your board members are spread between Bloemfontein and the coast, we can review the structure remotely and help you put it in better order. The goal is not just better settings, but calmer day-to-day operations.
Key facts
| Service name | Security Review |
|---|---|
| Scope | Access rights, password practices, account roles, shared mailbox use, calendar access and document permissions |
| Typical inputs | User list, admin list, shared mailbox list, collaboration folders, current access notes |
| Output | Findings summary with urgent fixes, medium-term actions and handover notes |
| Turnaround | Usually a few working days for smaller teams, longer for larger or multi-site setups |
| Maintenance interval | Every 6 months, or quarterly for teams with frequent staff changes |
