Is it safe to put donor data into AI?
If you trust your CRM with donor data, a paid AI plan with model training switched off can earn the same trust. Here's what to check first.
Is it safe to put donor data into AI?
It can be, if you choose the right plan and set it up well. On a paid plan with model training switched off and an audited security standard, donor data in AI sits in much the same place as donor data in your CRM. Most of the real risk lives in free tools.
Think about how your team already works. Nobody holds a meeting about whether donor records can go into the CRM.
Colleen Cook · Recorded conversation, Sep 8, 2026you don't question is it okay for us to put our sales data in Salesforce?
We trust those systems because trusting them is an established practice. Most of us have never read their security or privacy agreements. AI is new, so that habit hasn't formed yet, and that uncertainty is what I hear most from nonprofit leaders. They don't know where the line of safety is, so they can't tell when they're about to take a bad step. This article draws that line.
Why are free AI tools riskier for donor data?
Free AI usually runs on a trade. You get the tool at no cost, and the company gets to use what you type to train its models. Anything you put in can become part of what the model learns from, so it has to be safe to share. Donor data never meets that bar.
Colleen Cook · Recorded conversation, Sep 30, 2026the agreement you're making with that app when you're using free AI is that they get to use your data.
That's where most of the risk shows up. A staff member opens a free account to save time on a busy afternoon, pastes in a list, and nobody else knows it happened. The fix is simple. If you're passing data through AI, pay for it, and make sure the plan has the right data protection.
Paying is also how you get out of the trade. At different price tiers, AI companies give you the option to opt out of training their models, and on many paid plans that opt-out is the default. Plans and defaults change, so check the settings yourself every time you sign up or switch plans.
What should you check before choosing an AI plan?
Check three things before any donor data goes in: whether the company trains on your data and how you opt out, whether the product holds SOC 2 Type 2 certification, and whether your own AI policy allows the use. Then confirm the settings yourself, since defaults vary by plan.
The first question carries the most weight:
Colleen Cook · Recorded conversation, Sep 11, 2026this is just the biggest question you need to answer is, how is my data used to train models? Can I opt out of it?
SOC 2 Type 2 is a security standard for software. It tells you an outside auditor has checked how the company protects data over time. You'll usually find it on a vendor's security or trust page.
Use this as your checklist:
| Check | Where to look | What you want to see |
|---|---|---|
| Model training | Data or privacy settings in your account | Training on your data switched off |
| Plan | Billing or plan page | A paid team or business plan in your organization's name |
| Security | The vendor's security or trust page | SOC 2 Type 2 |
| Policy | Your nonprofit's AI policy | Donor data use named and allowed |
| The CRM test | Your own judgment | You'd be comfortable storing this same data in your CRM |
Scott and I run our work on a Claude Teams plan, and I feel good about where our data goes because it's a lot like putting it into a CRM. If your plan passes every row above, you're operating in a very similar environment.
Why does AI feel riskier than a CRM?
Because AI talks back, and it can act. A CRM stores what you give it and waits. AI responds, offers thoughts, and when it's connected to your other tools it can take actions on your behalf. That's a real difference, and the worry behind it deserves a real answer.
Scott named it well when we talked through a new report on nonprofit AI adoption:
Scott Williams · Recorded conversation, Sep 11, 2026this one has action and agency potentially that it can go out and do things with my thing. I think that's like the underlying potential fear of this.
At one of our intensives, an attendee asked about exactly this. They were worried about connecting too many tools to donor data. Scott's answer was that the protection has to come first, and the ambition can follow.
If you want to go to outer space, you gotta build a good space suit. It's just how you gotta do it.
The space suit is your setup. The right plan, training switched off, clear permissions for who can connect what, and a policy your team knows. Scott's rule of thumb holds once that's in place. If you feel good about putting data into your CRM, you can feel okay putting it into a paid AI plan set up this way.
Do you need consent to record donor conversations for AI?
Yes, ask every time. Recording conversations is one of the best ways to give AI real context about your donors, so tell people up front that you'd like to record and ask whether that's okay. If they'd rather you didn't, don't record. Debrief out loud on your drive back instead.
In our experience very few people say no, and asking builds trust on its own. Consent rules differ from state to state, so always follow what your state requires. If you work across state lines, the stricter rule is the safe one to follow.
How do you keep AI use ethical at your nonprofit?
Decide where AI belongs in your work and where it doesn't, write it down, and build your values into the systems themselves. Ethics is a set of choices your team makes once and then enforces in every tool, template and AI teammate, so nobody has to remember them under deadline.
Three practices help most:
- Draw your brand line. Be clear about where AI fits in your brand and where it doesn't. Scott's example is simple. When it's your mom's birthday, write her card with your own brain. Some donor moments deserve that same personal touch.
- Build in bias checks. For an If Possible customer, an advocacy nonprofit, we built rules into their AI copywriter that check its drafts for bias, so it wouldn't carry bias from the underlying model into their work.
- Put it in policy. Name what data can go into AI, which plans are approved, and who decides. Our guide to writing your nonprofit's first AI policy walks you through it, and the board conversation about AI helps you bring leadership along.
Once your guardrails are set, start using AI where it saves your team the most time. Your first 30 days with AI is a good place to begin, and the strategy hub has more on governance.
If you want help setting up AI safely, with the space suit built first, join the cohort waitlist. For more practical guidance on AI at your nonprofit, subscribe to our newsletter.
Frequently asked questions
Can I put donor data into free AI tools?
We don't recommend it. Free AI plans often use what you type to train their models, which means donor information could become part of what the model learns from. Use a paid plan in your organization's name, switch off training on your data, and confirm the setting yourself.
What is SOC 2 Type 2?
SOC 2 Type 2 is a security certification for software companies. It shows an independent auditor has reviewed how the company protects customer data over a period of time. Look for it on the vendor's security or trust page before your team puts sensitive information into any AI tool.
Is a paid AI plan as safe as our CRM?
With training on your data switched off and an audited security standard like SOC 2 Type 2, a paid AI plan puts your data in a very similar environment to your CRM. The difference is that AI can respond and take actions, so set clear permissions for connected tools.
Should our AI policy cover donor data?
Yes. Your policy should name which AI plans are approved, what kinds of donor data can go into them, how recorded conversations are handled, and who makes the call on new tools. A short, clear policy your team actually knows does more than a long one nobody reads.
Know an executive director who needs this?
