NGO IT support in Hong Kong has to work for a social worker on an outreach visit, a volunteer who joined for one flag day and a finance officer preparing a funder's report, all on the same thin budget. Brocent writes down what your service units, staff and volunteers actually need, applies Microsoft's and Google's nonprofit programmes correctly, and keeps donor and service-user records protected from our Kwun Tong office. Managed IT plans start from HK$195 per user per month in Hong Kong and S$100 in Singapore, with projects such as a new centre bought separately.
Hong Kong office since 2016: Workshop E, 3/F, Capital Trade Centre, No.62 Tsun Yip Street, Kwun Tong
EssentialsBusiness hours, 8×5 (09:00–18:00 local time), unlimited requests1 hour response / 4 hours remote resolutionOn-site visits bought separately as a token package (2 hours minimum per visit)
BusinessBusiness hours, 8×5, unlimited requests30 minutes response / 2 hours remote resolution1 visit a month included, 2 hours per visit (does not roll over)
Premium24×7, unlimited requests15 minutes response / 1 hour remote resolution2 visits a month included, 2 hours per visit (do not roll over)
P1 and P2 incidents: on-site within 4 business hours, or at a planned time. Project-level SLAs can be agreed separately. Full SLA and priority definitions →
Talk to us
Singapore (headquarters) Brocent Asia Cloud Service Pte. Ltd. 151 Chin Swee Road #14-05, Manhattan House, Singapore 169876 Email: accounts@brocent.com
Hong Kong (since 2016) Brocent Cloud Service (Hong Kong) Workshop E, 3/F, Capital Trade Centre, No.62 Tsun Yip Street, Kwun Tong Phone: (+852) 6741 7227 Email: accounts@brocent.com
01
What IT support for NGOs and charities covers
01
Helpdesk for staff, social workers and volunteers
One support line for head office, every service unit and staff working in the field, with tickets logged so you can see what each centre asked for.
Accounts set up and closed when you tell us who starts and who leaves. Volunteers get only the access their role needs, an end date for short-term access can be agreed in your scope, and shared mailboxes replace shared passwords.
Multi-factor sign-in policy on the Business plan, plus a one-off audit that finds open sharing links and old admin accounts on the folders and systems that hold case notes and donor lists.
An NGO that receives government subvention, foundation grants or public donations has to explain spending line by line. IT is awkward in that report: a support contract priced as one opaque figure, an emergency call-out after a virus, or licences bought for staff who left last year all invite questions from the board and the funder. Finance officers end up rebuilding invoices by service unit at year end because the provider never tagged costs to the centre or programme that used them. The problem is not only the amount; it is the lack of a record that shows what was bought, for whom and why.
What we do
A written scope that a funder can read
Before you sign, we list users by group, service units, devices and systems, and agree what the monthly plan covers and what is bought only when needed. If your finance team needs a cost centre or programme code on invoices, that can be agreed in the quotation. When a grant application needs an IT line, we give you the scope and the per-user figure from our published plans, so the number in the application matches what you will actually pay.
What you receive
Written support scope by service unit and user group
Per-user figure from our published plans for grant applications
Nonprofit licensing rules are easy to break by accident
Microsoft and Google both run programmes for registered nonprofits, and both attach conditions. Microsoft separates granted licences, which are for paid staff and unpaid executive staff, from discounted ones that volunteers may use, and asks the organisation to attest its eligibility on a regular cycle and to keep granted licences in active use. Registration must be done by someone inside the organisation. In practice, licences get handed to volunteers, left on the accounts of former staff, or bought at full commercial price because nobody knew the NGO qualified. Any of these can put the offer at risk or waste money the funder expected you to save.
What we do
Nonprofit licensing applied and kept compliant
Your own staff member or strategic volunteer registers with Microsoft or Google, as both programmes require; we prepare the information with you, such as your charity registration evidence. Once eligibility is confirmed, we assign the licences to the right people, move volunteers off granted licences and remove licences from leavers. Before the yearly attestation we review usage with you, so the person signing knows the position. If Google Workspace suits you better, we set up its nonprofit edition the same way.
People come and go faster than accounts are closed
A typical Hong Kong NGO has permanent staff, contract staff on a project grant, social work students on placement, and volunteers for flag days, tutoring programmes or elderly visits. Each group needs different access, and each leaves on a different schedule. When there is no routine, a placement student keeps the shared drive after the term ends, a former project officer still receives the donor mailing list, and a volunteer's personal Gmail is the owner of a Google Form that collected participants' phone numbers. Nobody notices until something goes wrong.
What we do
Joiner, leaver and volunteer routines
Every plan includes joiners and leavers: tell us who starts and who leaves, and we set up or close accounts and devices. How a leaver's mail and files are handed over, for example to a named manager, can be agreed in your scope. Volunteers and placement students get only the access their role needs: the folders their programme uses, and no access to donor or case systems unless the role requires it; an end date for their access can be agreed. Shared mailboxes replace shared passwords for centre front desks. On the Business plan, the quarterly review gives you a fixed point to confirm which accounts should be closed.
Case notes about families in crisis, medical details of elderly members, records of children in after-school programmes, donor names with their payment details: an NGO holds some of the most sensitive personal data in the city, often in spreadsheets, email attachments and folders shared by link. Social workers photograph forms on their own phones during home visits. A single phishing email to a centre's general mailbox, or a folder link forwarded to the wrong group chat, can expose people who had little choice about giving you their information.
What we do
A security check of the systems that hold personal data
A one-off Microsoft 365 security audit finds what most often exposes NGO data: folders shared to anyone with the link, accounts without multi-factor sign-in, old admin accounts and mail forwarding to personal addresses. The report ranks fixes by risk; the fixes can then be carried out under your plan or quoted separately. For centres where staff photograph documents during home visits, device management separates work data from personal content, so work data on a lost phone can be wiped without touching personal photos.
What you receive
Audit report with a fix list ranked by risk
MFA policy and conditional access on the Business plan
Larger NGOs run elderly centres, youth centres, family service units and shops from different addresses, each with its own broadband line, printer, shared PC and slightly different way of working. IT is usually looked after by an administration or finance manager at head office who also handles procurement and premises. They cannot visit every unit when a printer fails or Wi-Fi drops, and they do not have time to learn device management or backup tools. What they need is one place to call and a record of what was done.
What we do
Backups you can restore, with evidence
We back up cloud mailboxes, shared drives and the folders where case records live, and we test restores. If a staff member deletes a programme folder or ransomware encrypts a centre PC, we restore from the most recent clean copy. When a funder, auditor or your board asks how service-user data is protected, a restore test that worked is stronger evidence than a setting that was switched on; which written reports you receive follows your scope.
What you receive
Backup scope agreed in writing
Restore tests
Cloud backup of 50 GB per user on the Business plan
Equipment is often bought when a one-off grant arrives, so a centre ends up with a batch of laptops that all age at the same time, donated machines of mixed brands, and no money left for the software and support to keep them safe. Renewals land in the wrong financial year. Projects such as opening a new centre or moving office need IT work that the monthly budget never covered. Without planning, the NGO pays emergency rates for work that could have been scheduled and costed in the grant application.
What we do
Projects bought separately with IT tokens
Opening a new centre, moving office, setting up a fundraising event or refreshing a batch of grant-funded laptops can be bought as prepaid IT tokens, kept apart from the monthly plan. Each job ends with a service report signed by your authorised representative, and a weekly token balance report shows what remains, so you can attach the cost to the grant that paid for it. When donated or old devices leave the organisation, our IT asset disposal service wipes them and issues a certificate per device, so personal data does not leave with the hardware.
Essentials HK$195 · Business HK$295 · Premium HK$430
EssentialsRemote support in business hours · HK$195 / S$100 per user
Desk
Business hours, 8×5 (09:00–18:00 local time), unlimited requests
Response
1 hour response / 4 hours remote resolution
Devices
RMM monitoring, patching, antivirus status checks
Identity
Microsoft 365 / Google user management (joiners and leavers)
On-site
On-site visits bought separately as a token package (2 hours minimum per visit)
Reports
Monthly report: tickets, assets, patches
People
Shared service desk
BusinessSecurity tooling, an account manager and on-site visits · HK$295 / S$150 per user
Desk
Business hours, 8×5, unlimited requests
Response
30 minutes response / 2 hours remote resolution
Devices
Essentials, plus managed EDR and cloud backup (50 GB per user)
Identity
Essentials, plus MFA policy and conditional access
On-site
1 visit a month included, 2 hours per visit (does not roll over)
Reports
Essentials, plus quarterly review and asset register
People
Shared service desk, plus account manager
Premium24×7 cover and a named desk agent · HK$430 / S$220 per user
Desk
24×7, unlimited requests
Response
15 minutes response / 1 hour remote resolution
Devices
Business, plus MDR, managed firewall, DMARC and email security
Identity
Business, plus privileged account management
On-site
2 visits a month included, 2 hours per visit (do not roll over)
Reports
Business, plus multi-country head-office summary, compliance mapping (ISO 27001 / DPDP / APPI / GDPR) and vCIO annual roadmap
People
Account manager, plus named service desk agent
Wording is taken from the home-page plan table. Project-level SLAs can be agreed separately. SLA · Price assumptions
What a Hong Kong NGO's IT environment usually looks like
Most NGOs we meet in Hong Kong run on Microsoft 365 or Google Workspace, often obtained through the vendor's nonprofit programme years ago and never reviewed since. Head office has a finance system, a donor or membership database, and a shared drive organised by department. Each service unit, whether an elderly neighbourhood centre, an integrated youth centre or a family service unit, has a few shared desktops, a multifunction printer, its own broadband line and a router that nobody remembers the password for.
Around this core sit the systems that make NGO work different from an ordinary office. There is a case management or service records system, sometimes a commercial product and sometimes a spreadsheet that grew over a decade. There are online donation forms and a receipting process for donations that donors will claim against tax, because the organisation is recognised under section 88 of the Inland Revenue Ordinance. There are sign-up forms for programmes and volunteers, frequently built by a staff member in a free tool under a personal account.
Then there are the people. Social workers carry phones on outreach and home visits and may photograph consent forms or documents. Programme staff on fixed-term grants come and go with the funding. Placement students and volunteers need access for weeks rather than years. Board members, who are often volunteers themselves, receive confidential papers by email. Each of these groups touches personal data, and each needs a different level of access.
Finally, there is the hardware history. Laptops are bought in batches when a grant arrives, donated equipment of mixed age sits alongside new machines, and old devices are kept in a storeroom because no one is sure how to dispose of them safely. A good NGO IT support arrangement starts by writing all of this down, because the risks and the costs both come from the gaps between these pieces, not from any single system.
How to choose an IT provider for a charity: a procurement checklist
Many NGOs buy IT support through a quotation exercise under their procurement policy, and the board or a funder may review the result. The cheapest monthly figure is rarely the best measure. Ask each provider to quote against the same written scope: number of users by group, number of service units, devices, systems and the hours of cover you need. If a provider will not quote against a scope, you cannot compare them and you cannot explain the choice later.
Next, check how the provider handles nonprofit licensing. A provider who offers to register your organisation with Microsoft on your behalf is a warning sign, because Microsoft requires an employee or strategic volunteer to do it. Ask instead how they will map users to granted and discounted licences, and how they will prepare you for attestation. Ask the same about Google Workspace if you use it, since its nonprofit edition is verified through a validation process that your organisation completes.
Then look at data handling. Under the Personal Data (Privacy) Ordinance, an NGO that uses an IT contractor must use contractual or other means to prevent personal data being kept longer than necessary and to prevent unauthorised access. Ask for the contract clauses, who at the provider can see your data, and what happens to it when the contract ends. Ask for a sample of the evidence you will receive: restore test records, access reviews, an audit report.
Finally, test the fit with how you work. Will staff at a centre in Tin Shui Wai and a social worker in a client's home both reach the helpdesk? Can the provider support Cantonese, English and Mandarin speakers? Can it cover an office in Singapore or elsewhere if you have one? Can it take over from your current provider or work alongside an in-house IT officer? Brocent publishes its plans and pricing assumptions so you can check the figures yourself, and our Hong Kong team supports English, Cantonese and Mandarin.
Funder accountability, data protection and what evidence to keep
NGOs answer to more parties than most small organisations: the board, government departments that subvent services, foundations, auditors, donors and the people they serve. Each may ask a version of the same question: how do you protect the personal data entrusted to you? The Social Welfare Department's NGO IT Information Portal gathers IT security references for the welfare sector, and points NGOs to the Privacy Commissioner's guidance on data security and on data breach handling. Those documents describe the expected practices in plain terms.
Under the Personal Data (Privacy) Ordinance (Cap. 486), Data Protection Principle 4 requires all practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or use. For an NGO that usually means: knowing where case and donor data is stored, limiting access by role, using multi-factor sign-in, encrypting devices that leave the office, keeping backups and being able to show that these things were done. Part 6A adds rules on direct marketing, and the Ordinance treats soliciting donations as a form of marketing, so donor data needs the right consent before it is used for appeals.
Evidence matters as much as controls. When a board member or funder asks, a statement that multi-factor sign-in is enabled is weaker than a dated report showing which accounts have it. Managed clients receive written reports: the monthly report covers tickets, assets and patches, the Business plan adds a quarterly review and an asset register, and a one-off audit gives a fix list ranked by risk. Together with restore tests, these are records you can attach to an annual report, a funder's review or an internal audit.
In Singapore, the Personal Data Protection Act 2012 applies to charities, and its Protection Obligation in section 24 requires reasonable security arrangements. The Charity Council's Code of Governance for Charities and IPCs sets six governance principles for boards, and notes that volunteers involved in day-to-day operations should follow the practices that apply to staff. We implement the controls and keep the evidence; legal interpretation of any of these rules stays with your adviser.
What NGO IT support costs and what drives the figure
Managed IT for NGOs is priced per user per month. Our plans start from HK$195 in Hong Kong and S$100 in Singapore, and the calculator on our home page shows the figure for your headcount. The assumptions behind the numbers, such as what counts as a user, are on our pricing assumptions page, so you can check them before putting a figure into a grant application.
Four things move an NGO's cost more than anything else. The first is how you count users: permanent staff need full support, while volunteers who only use a shared mailbox or a form may not need a licence or a support seat at all. The second is the number of service units, because each address has its own network and devices. The third is the hours of cover; most NGOs work office hours, but residential and hotline services may need evening or weekend support. The fourth is project work, such as a new centre, an office move or a device refresh, which we quote separately as IT tokens so it does not inflate the monthly figure.
Licensing is a separate line. Nonprofit offers from Microsoft and Google can reduce software costs substantially for eligible organisations, but they do not cover support, backup or security tools. Licences and third-party subscriptions are priced on their own pages and appear on your quote only if you add them, so the board sees each one separately. Some NGOs also find that a one-off security audit or awareness training fits better in a capacity-building grant than in the operating budget.
The figure that matters to a funder is predictability. A written scope, a known per-user price and projects costed in advance mean the IT line in your budget holds through the year, and the explanation in your grant report is short.
05
The first 30 days
Week 1: inventory and scope
We list users by group, service units, devices, systems and existing licences, then agree the written scope.
Week 2: accounts and licensing
We close stale accounts you confirm, set up the joiner and leaver routine, assign licences to users and fix volunteer assignments.
Weeks 3 to 4: protect the sensitive data
Multi-factor sign-in for staff who reach case and donor data, sharing-link clean-up, backup set-up and a first restore test.
Day 30: first monthly report
Your first monthly report covers tickets, assets and patches; on the Business plan the asset register is in place and the quarterly review is scheduled. Free onboarding hours depend on the plan.
06
Verifiable delivery: adjacent sectors
We have no signed contract in this sector that we can publish yet. The signed contracts below are from adjacent sectors; they show the same delivery methods (resident engineers, multi-site on-site visits, network installation). They are not case studies from this sector.
Adjacent sector
Adjacent sector: an international market research and advisory firm — on-demand on-site support across offices
An advisory firm, not an NGO. It shows on-demand visits to a Hong Kong office, with the same client also contracting on-site support or storage in Australia and South Korea; an NGO with small offices in several places can be covered the same way.
Service: on-demand on-site support (FSE) and IT equipment warehousing (WMS)
Region: Hong Kong, plus Australia and South Korea
Term: signed 2025, renewed 2026
Adjacent sector
Adjacent sector: a global pharmaceutical company — full-time and part-time resident engineers
A pharmaceutical company, not an NGO. It shows a part-time resident engineer three days a week alongside full-time placements, a format that suits an NGO head office that needs someone on site but not every day.
Client type: pharmaceutical company
Service: full-time and part-time resident engineers (FTE / PTE)
Region: Hong Kong, Taiwan, South Korea, mainland China; briefly two offices in Europe in 2025
Term: since 2023, current contract runs to 2028
07
Regulation we design the controls around
We implement the controls and keep the evidence; legal interpretation stays with your own adviser.
Cap. 486, DPP4
Hong Kong: Personal Data (Privacy) Ordinance, data security
Data Protection Principle 4 requires practicable steps to protect personal data, and an NGO that uses an IT contractor must bind it by contract to protect and not over-retain that data. For case notes and donor records we apply role-based access, multi-factor sign-in and tested backups. We implement the controls and keep the evidence; legal interpretation stays with your adviser.
Hong Kong: PDPO Part 6A, fundraising as direct marketing
Section 35A treats the solicitation of donations as direct marketing, so donor data needs consent before it is used for appeals. The Privacy Commissioner's Guidance on Direct Marketing explains the steps. We configure consent fields, opt-out lists and mailing permissions in your CRM and email tools. We implement the controls and keep the evidence; legal interpretation stays with your adviser.
Hong Kong: Inland Revenue Ordinance section 88 charities
Charities recognised under section 88 issue receipts that donors use for tax deductions, and that status is also a common piece of evidence when applying for vendor nonprofit programmes. We protect the donor and receipt records behind it and keep your registration documents ready for licensing checks. We implement the controls and keep the evidence; legal interpretation stays with your adviser.
Official text ↗Charities Act 1994; Code of Governance (2023)
Singapore: Charities Act 1994 and the Code of Governance
Registered charities and IPCs follow the Charities Act and the Charity Council's Code of Governance, which sets board oversight principles and expects volunteers in day-to-day roles to follow staff practices. The written reports and restore tests described above give the board material for that oversight. We implement the controls and keep the evidence; legal interpretation stays with your adviser.
Charities are covered by the PDPA. The Protection Obligation in section 24 requires reasonable security arrangements, and a notifiable data breach must be reported to the PDPC within 3 calendar days of assessing it. We put the controls in place and help you assess an incident quickly. We implement the controls and keep the evidence; legal interpretation stays with your adviser.
Managed IT plans are priced per user per month and start from HK$195 in Hong Kong and S$100 in Singapore. The calculator on our home page gives the figure for your headcount. Projects such as opening a centre or moving office are quoted separately as IT tokens, so the monthly figure stays predictable. We agree a written scope first, so the amount in your grant application matches what you pay.
Can our IT provider register us for Microsoft's nonprofit offers?
No. Microsoft requires an employee or strategic volunteer of the organisation to register, and third parties, including IT providers, cannot do it for you. We help you prepare the information, such as your charity registration evidence, and once Microsoft confirms eligibility we assign the licences and review usage with you before each yearly attestation.
Should an NGO use Microsoft 365 or Google Workspace?
Both run nonprofit programmes, and both work for NGOs. The deciding factors are usually the tools staff already know, the donor or case system you use and whether partners send you Word and Excel files. We support either, and can migrate between them. Our blog compares the two for organisations in Asia if you want a longer view.
Can volunteers use donated Microsoft 365 licences?
Microsoft separates grants from discounts. Granted licences are for paid staff and unpaid executive staff such as board members in executive roles, while discounted licences may be used by staff and volunteers. Many volunteers need neither: a shared mailbox or a form may be enough. We map each person to the right option, and an end date for volunteer access can be agreed in your scope.
Can you work within our existing budget constraints?
Yes. We start from the budget line you have and build the scope around it: which users need a full support seat, which centres need on-site visits, and which work can wait for a grant. If something important does not fit, we say so in writing so the board can decide, rather than leaving a gap that surfaces after an incident.
Our charity runs a school or a clinic. Do Microsoft's nonprofit offers still apply?
Microsoft's eligibility rules exclude certain types of organisation, including schools and universities and most hospitals and health systems. An NGO that runs a kindergarten, school or clinic alongside social services should check eligibility for each entity with Microsoft before planning around the offer. Our education and healthcare pages describe how we support those settings.
We have no IT staff. Who do our people call, and when?
Staff call, email or use the portal to reach our helpdesk; the Hong Kong team supports English, Cantonese and Mandarin. Essentials covers weekdays 8x5 with a 1-hour response and 4-hour remote resolution; Business adds a 30-minute response, 2-hour remote resolution and one on-site visit a month; Premium covers 7x24. Details are on our SLA page.
Do you offer 24/7 support for residential or hotline services?
Yes, on the Premium plan, which covers 7x24. Many NGOs put only the units that run around the clock, such as a residential home or a hotline, on Premium and keep office-hour units on Essentials or Business. Project-level service levels can also be agreed for specific events.
Do you support NGOs with offices in Singapore or other countries?
Yes. We have offices in Hong Kong and Singapore and 11 local legal entities supporting clients in 100+ countries and regions, so a regional office and its country programmes can sit under one arrangement. Singapore charities follow the PDPA and the Code of Governance, and we keep records that support both.
Can you set up IT for a new centre or an office move?
Yes. We plan the broadband, network, printers, devices and accounts for the new address, and the timing of the move or set-up is agreed in the quote. This is quoted as a project with IT tokens, separate from the monthly plan, so it can be charged to the grant or capital budget that funds the new centre.
How do you protect donor data used for fundraising?
We configure the systems: consent fields and opt-out lists in your CRM and mailing tools, role-based access to donor records and multi-factor sign-in; DMARC and email security, included on the Premium plan, make appeals harder to spoof. Under PDPO Part 6A, soliciting donations counts as direct marketing; whether your consent wording is sufficient is a question for your legal adviser.
Can you take over from our existing IT provider or volunteer helper?
Yes. We collect admin credentials, licence records and network details, then document what we find during onboarding. Where a volunteer or former staff member owns an account or domain, we help you move ownership to the organisation so no critical service depends on one person's personal account.
Will you work alongside our in-house IT officer?
Yes. Many NGOs keep one IT or admin officer for local knowledge and use us for helpdesk overflow, security, backup and projects. We agree who handles what in the written scope, and reports can go to both of you.
What happens to donated or old laptops that held personal data?
Before a device is reused, donated onward or recycled, our IT asset disposal service wipes it and issues a destruction certificate per device showing the serial number, method and date, which you can file with your asset register.
