Do you work with churches and private schools?

Both are common in our area and both are a reasonable fit. They share most of the nonprofit pattern, which is a small budget, a lot of turnover among people with access, and one person carrying more than they should. They add a few things of their own.

Data about minors changes the calculation. For a school, or a church with youth programs, you hold records about children, and that raises the stakes on the same systems everyone else runs. Photo permissions, contact records, and anything shared with parents need to be handled deliberately rather than in a shared folder everyone can reach. Schools should also know that the federal student records rules apply to how records are stored and disclosed, and that your system setup either supports that or quietly does not.

Background check and volunteer records are sensitive. Whoever keeps them, they should not live on a shared drive or in a spreadsheet in an email attachment. This is one of the most common findings we have when we look at a church environment.

The building is used by people who do not work there. Groups meeting in the evening, a preschool renting space, events at the weekend. Guest Wi-Fi that is genuinely separate from the network holding your financial and member data is the baseline, and it frequently is not separate at all. This is a half day fix with a disproportionate benefit.

Giving and tuition mean payment data. Same rule as anywhere: the processor holds the card, you do not. Worth checking what your giving platform or tuition system actually stores.

A school has an additional layer, being classroom technology, a student information system, filtering requirements if you take federal funding, and devices in the hands of students. That is a bigger conversation than a church office and we are happy to have it, including being honest about where a school needs someone with more education-specific depth than we have.

One thing worth saying to a church specifically: volunteers with administrator access are the most common risk we find, usually a well meaning member who set up the systems years ago and still has the keys. Nobody wants to have that conversation. It is worth having, and we will help frame it as a normal governance matter rather than a question about anyone's trustworthiness.