Download PDF (503 KB)
PDF version, ready to print or share with your team.
Yes, a non-profit can use Claude Cowork to draft grants, reports, and donor communications on a Team or Enterprise plan, with access scoped to a single program folder so donor and program data stays protected. Fusion Computing, Canadian-owned since 2012, sets up the privacy guardrails and oversight logging, CISSP-led.
The non-profits that win with AI are not the biggest. They are the ones that scope it to one campaign folder, log every output, and keep a human on donor-facing copy.
Non-profit teams want to know whether Claude Cowork can lighten the grant and communications load without exposing donor data. According to Statistics Canada (2026), 20.4% of Canadian non-profit organizations used AI in the 12 months to the second quarter of 2026, slightly ahead of the 19.0% recorded for private-sector businesses.
Mike Pearlstein, CISSP, MSc Computer Science (AI), founder of Fusion Computing, which has secured IT for Canadian non-profits and charities across Toronto, Hamilton, and Metro Vancouver since 2012.
Key takeaways
- Claude Team runs from 2 to 150 members at US$20 per seat per month billed annually, and Anthropic discounts Team and Enterprise by up to 75% for eligible charities.
- Scope it to one program, never the whole donor database.
- Local Cowork sessions sit outside your audit trail. Sessions run in the vendor cloud are captured in the Compliance API instead.
- PIPEDA binds a charity only where it acts commercially, such as leasing a supporter list, while British Columbia’s PIPA covers every organization. Ontario’s Bill 194 cyber duties land on a short prescribed list that most charities are not on.
Can non-profits use Claude Cowork with donor and program data?
Yes, on a Team or Enterprise plan with access scoped to one program folder and a written policy. According to Anthropic’s commercial terms (2026), “Anthropic may not train models on Customer Content from Services.” Your obligations to donors and funders survive that promise, and no vendor setting retires them.
The control that matters is scope: which files the agent opens, which plan governs the data, then who checks the output before a donor or a funder sees it. Donor trust in Toronto and Vancouver rests on keeping personal information contained, so the setup around the tool is what keeps it safe.
It’s the same secure-adoption logic from the pillar guide on using Claude Cowork securely in your business, applied to a charity, and it sits alongside our broader IT support for non-profits and charities work.
What does Claude Cowork actually do for a non-profit?
According to Anthropic’s release notes (2026), Cowork reached general availability on macOS and Windows on April 9, 2026. It completes multi-step document work instead of answering one question. For a charity that means grant assembly, appeal drafting, impact reporting, board paperwork and volunteer materials. Every output is a draft a person verifies.
Here’s how those jobs map to the work, with the guardrail that protects donors. Fusion Computing walks organizations through this before any pilot, the same way we scope any AI services engagement.
Book a 30-minute call to scope Claude Cowork for your organization safely →
| Task | What to test | The guardrail |
|---|---|---|
| Grant and funding applications | Assembles applications from program materials | Internal program data, reviewed before filing |
| Donor communications and appeals | Drafts appeals and thank-you messages | Donor identifiers stay in a scoped folder |
| Program and impact reports | Drafts reports from program data | A draft for review, figures checked |
| Policy and board documents | Writes and organizes policies and minutes | Internal documents, no donor data |
| Event and volunteer documents | Drafts event and volunteer materials | De-identified or admin data only |
Treat these as pilot hypotheses to validate in your own tenant, not vendor-guaranteed capabilities. Anthropic documents a subset of them directly; the rest are workflows to test before a firm relies on them.
The donor-data and privacy guardrails
Least privilege is the whole control: scope Cowork to one program folder, not the donor database. Classify what may go in, which is the working documents for the active program, and what stays out, which is supporter history beyond that folder. According to Anthropic’s safety guidance (2026), prompt-injection risk stays “non-zero”.
The first thing I check is scope. When a Hamilton charity connects the agent to its whole supporter database, 1 task can read every record it holds. Scope it to the active program and you’ve cut most of the exposure without changing the work.
FIELD NOTE FROM MIKE. The first thing I change is access. I’ve watched a development lead point an agent at a CRM export carrying every donor’s giving history. We scoped it to one campaign folder, and the workflow that felt reckless became routine. The work’s identical; the exposure isn’t.
Of the three approval modes Anthropic documents, the one I set for a charity is Manually approve. Deletion is protected in every mode, because Cowork “requires your explicit permission before permanently deleting any files.” Useful, though in my view no substitute for scoping the folder properly in the first place.
The policy is the other half. A short rule set, the kind we cover in our guide on what belongs in an AI acceptable use policy, names the approved tool, the data that may go in, and who may run it. Fusion Computing pairs that with a cybersecurity review so the organization protects the trust its funding depends on.
Which privacy law actually requires anything of your charity?
Most Canadian charities are not covered by PIPEDA at all. According to the Office of the Privacy Commissioner (2026), the trigger is commercial activity. Collecting membership fees, mailing newsletters and raising money do not meet that test, so they never pull an organization into the Act.
CONTRARIAN THESIS. The sentence “PIPEDA governs our donor data” is usually wrong, and believing it makes charities buy the wrong controls. PIPEDA defines commercial activity to include “the selling, bartering or leasing of donor, membership or other fundraising lists”. Lease your list once and you are in scope. Never lease it and, in Ontario, no federal privacy statute touches your appeals at all.
The first thing I ask a board is which province the organization is registered in, because the answer changes the statute. Geography changes it that much. British Columbia’s Personal Information Protection Act defines an organization to include “a not for profit organization” and covers every organization, with no such test. A Vancouver society is squarely covered where an Ontario one may not be.
There is one residency rule, and it is tax law rather than privacy law. Income Tax Act subsection 230(2) requires a registered charity to keep its records and books of account “at an address in Canada recorded with the Minister or designated by the Minister”. That is why we treat the source documents differently from the drafts.
Ontario’s Bill 194 is narrower than most boards think. Its cyber duties arrive through O. Reg. 51/26, which prescribes 5 categories: educational institutions under FIPPA, Group A, B or C public hospitals, the University of Ottawa Heart Institute, children’s aid societies, and school boards. Public funding alone does not put a charity on that list. Our guide on whether Bill 194 applies to your non-profit works through the edge cases.
The oversight gap for funder and privacy audits
Where a Cowork session runs decides whether you can produce a record of it. According to Anthropic’s admin guidance (2026), local session history sits on the user’s computer and “cannot be centrally managed or exported by admins.” Sessions run in the cloud are captured in the Compliance API instead.
That split is the setting I check first on any engagement. Cloud sessions are on by default for Team plans and off by default for Enterprise, where an owner enables them and then grants the capability through custom roles. A charity that wants a retrievable trail of AI-assisted work should be running in the cloud deliberately.
The Enterprise audit logs capture metadata rather than the work itself. Team and Enterprise owners can also stream Cowork events to a SIEM through OpenTelemetry, which Anthropic notes “doesn’t replace audit logging for compliance purposes. Cowork exports the full text of user prompts by default, along with tool parameters, file paths and user email addresses, so configure filtering or redaction at the collector and set SIEM access and retention before enabling export.” Our engineers found that stream is where tool calls and file access become visible.
If the pilot needs centralized monitoring, define the destination, filtering, access and retention before enabling OpenTelemetry. If a document supports a funder report, keep that record on purpose.
Cowork versus the AI inside your donor database
Donor-management AI is embedded in a giving platform and is scoped to that platform’s data. A general desktop agent like Cowork works across your own files instead. The practical difference is blast radius: a propensity model sees 1 dataset, while an agent sees whatever folder and connectors you granted it 5 minutes ago.
My rule is simple: if a document crosses two systems, it belongs to the agent. That cuts both ways. A platform vendor already carries part of your control burden and can usually hand you a trail. With Cowork the organization owns the scoping decision, so the upside is that the agent handles the awkward cross-system documents no donor system ever covered, such as a 40-page funder report drawing on 6 program spreadsheets.
Anthropic also ships Cowork connectors for Benevity, Blackbaud, and Candid under its non-profit programme, which narrows the gap for organizations already standardised on those systems.
How much does Claude Cowork cost for a charity?
According to Anthropic’s published pricing (2026), Claude Team is built for 2 to 150 members at US$20 per seat per month billed annually, or US$25 billed monthly. Enterprise is US$20 per seat plus usage charged at API rates. Charities pay less than either figure.
Anthropic announced Claude for Nonprofits on December 2, 2025, cutting Team and Enterprise by up to 75% for eligible organizations, plus a free AI Fluency for Nonprofits course built with GivingTuesday. On a 5-seat Team plan that rate takes the annual licence from roughly US$1,200 to US$300.
In our practice the licence is rarely the expensive part. The real cost sits in scoping, policy drafting and the monitoring wiring, which we scope at 3 to 6 hours for a mid-sized Ontario charity rather than a per-seat charge. That is why I tell boards to file the eligibility paperwork early, then price the control work before the seats.
Plan tier and a setup checklist for a non-profit
Plan tier is the first decision, because only Team and Enterprise carry the contractual no-training commitment plus admin controls. From there a safe rollout is short: scope to one program folder, keep Manually approve on, decide the cloud-session question, put a donor-data rule in the policy, turn on telemetry, and keep a leader signing off.
Need the policy first? Use our AI acceptable use policy template.
The contrast with a staff member’s own account is stark. According to Anthropic’s privacy centre, an individual plan with the improvement setting enabled may retain chats “in a de-identified format for up to 5 years in our model training pipelines”. Business inputs and outputs are deleted within 30 days by default.
Get a CISSP-led review of where AI tools touch your donor data →
Why Canadian firms bring this work to Fusion Computing
CISSP-led, a Microsoft Solutions Partner and a CompTIA Managed Services Trustmark holder, securing IT for Canadian SMBs across Toronto, Hamilton, and Metro Vancouver since 2012.
- Choose Team or Enterprise. Donor data on a staff member’s own account is the first risk to fix.
- Claim the charity pricing. Up to 75% off changes the board conversation before it starts.
- Scope to one program folder. Never the whole donor database. Widen only with a reason.
- Set the approval mode to Manually approve. Deletion always prompts, but the other actions should too.
- Decide the cloud-session question. Team has it on by default; Enterprise owners must switch it on deliberately.
- Put a donor-data rule in the policy. Supporter identifiers stay in scope or out of the tool.
- Turn on telemetry monitoring. On local sessions it’s an additional visibility stream into what the agent did.
- Keep a leader signing off. Nothing donor-facing or funder-facing ships without review.
FIELD NOTE FROM MIKE. I ask one question before any of the 8 steps above: who reviews this document today, when a person writes it? If nobody can name that reviewer, the AI pilot is not the problem I want to solve first. That question surfaces an informal review step in a good share of our clients, and Cowork simply makes the gap visible sooner.
None of it’s exotic. The technical setup can be quick; the privacy, logging and approval work is what decides how long the pilot takes. Fusion Computing sets it up as part of the managed IT work we already do for charities, and the same pattern carries to Ontario municipalities and to accounting firms under their own rules.
Fusion Computing helps Canadian businesses across Toronto and the GTA, Hamilton, and Metro Vancouver with managed IT, cybersecurity, and Microsoft 365.
Where a non-profit should start this week
Claim the non-profit discount, buy 2 Team seats, scope them to one live program folder, set approvals to Manually approve, and answer the cloud-session question in writing before anyone opens a second folder. For a CISSP-led second opinion first, talk to us or read more about how we work.
Frequently Asked Questions
Is Claude Cowork safe for donor data?
Claude Cowork can be safe for donor data on a Team or Enterprise plan, with access scoped to one program folder and someone reviewing the output. Team and Enterprise do not train on organization content by default, but that alone is not a confidentiality determination: verify the execution mode, Anthropic’s current terms and DPA, retention, the applicable privacy law and your professional obligations before client data is used. The contract states that Anthropic may not train models on Customer Content, and business inputs and outputs get deleted within 30 days by default. Expose only the documents a task needs.
Can Claude Cowork draft grant applications?
Yes. Cowork can assemble grant and funding applications from your program materials, past submissions, and outcomes data, which saves a small team real time. Treat the draft as a starting point for a person to review and tailor to the funder. Keep the source materials in a scoped folder so the agent sees only the active program.
What plan do we need, and is there non-profit pricing?
Use Team or Enterprise for donor or program data. Team is built for 2 to 150 members at US$20 per seat per month billed annually. Anthropic launched Claude for Nonprofits on December 2, 2025, giving eligible organizations up to 75% off Team and Enterprise, plus connectors for Benevity, Blackbaud, and Candid. Plan tier rather than price is the security decision.
Is our data used to train the model?
On Team and Enterprise plans, the contract says Anthropic may not train models on Customer Content from the Services. A personal Pro or Max account is different: with the improvement setting enabled, chats may be kept in de-identified form for up to 5 years in Anthropic’s training pipelines. That gap is the reason to buy business seats.
Want an AI use policy that protects donor privacy and funder trust? →
Does PIPEDA apply to our charity?
Only if you engage in commercial activity. The Privacy Commissioner is explicit that membership fees, newsletters, and appeals do not meet that test, so most charities fall outside PIPEDA. Selling, bartering, or leasing a donor or membership list does meet it and brings you in. In British Columbia, PIPA covers every organization including a not-for-profit regardless.
Does Bill 194 apply to us?
Probably not. Ontario’s O. Reg. 51/26 under Bill 194 prescribes 5 categories: educational institutions under FIPPA, Group A, B or C public hospitals, the University of Ottawa Heart Institute, children’s aid societies, and school boards. Receiving public funding does not by itself put a charity on that list. A children’s aid society, by contrast, is squarely in scope.
Does Claude Cowork work on Windows, or only Mac?
Both, and more since it launched. Cowork reached general availability on macOS and Windows through the Claude desktop app on April 9, 2026. On July 7, 2026 Anthropic added web at claude.ai and the Claude mobile apps, in beta for Team and Enterprise, with those sessions running on the vendor’s infrastructure rather than a laptop. Confirm the current feature list inside the app.
Who at the organization should run Claude Cowork?
Start with a small group in development or programs who understand donor privacy. The Cowork toggle itself is organization-wide, so a Team plan is all-or-nothing. On Enterprise, groups and custom roles let an admin enable Cowork, or the cloud-session capability, for named teams only. Pair whichever you choose with the CISSP-led review Fusion Computing runs before a pilot starts.
