Choosing a charity CRM after the Beacon breach: questions to ask any supplier
In August around 1,500 UK charities learned their supporters' details had been taken from their CRM. What to ask whoever holds your donor data, us included.
On 4 August 2026 Beacon, a CRM used by around 1,500 UK charities, disclosed that a compromised access key had been used to get into its systems. Supporters' names, email addresses, phone numbers and donation records were taken, and Beacon told its customers to assume everything they stored, attachments included, had been downloaded. It said no payment card, bank account or patient information was held in the system. Charities named in the reporting included hospices and Victim Support (Infosecurity Magazine, 7 August 2026).
This isn't a piece about one supplier. Every charity that keeps donor records with a software company is trusting that company with the same thing. These are the questions worth asking any of them, and we expect to be asked them too.
Where the data is, and who can reach it
- Where is our data hosted? Which country, and which company's servers.
- Is our data kept apart from other charities' data? One database shared by every customer means one way in reaches all of them.
- Who at your company can see our records, and is that access logged?
- How are your own passwords and access keys stored, and how often are they changed? A leaked key was the way in here.
Access on our side
- Is two-step sign-in required for our staff, or optional?
- Can we limit what each person sees? A fundraiser doesn't need finance; a trustee may only need to read. Fewer people seeing everything means less exposed if one account is taken.
- Is there a log of who looked at or changed what? After an incident, this is how you find out what was reached.
What you keep, and for how long
- Do we need to store everything we store? Attachments, scanned forms and free-text notes often hold more than the record needs. What isn't there can't be taken.
- How long are deleted records and old backups kept?
- Can we export everything, and have it deleted, when we leave?
If it happens
- How quickly will you tell us, and what will you tell us? A charity has 72 hours to report a personal data breach to the ICO once it knows about it (ICO), so the supplier's notice period matters.
- Who do we talk to, and will you help us write to our supporters?
- What security certification do you hold, such as Cyber Essentials, and when was it last renewed?
Our answers
We are a supplier like any other, so here is where we stand on the parts we can show: two-step sign-in for staff, roles that limit each person to what their job needs (finance, fundraising, trustees, overseas partners), an activity log of who changed what, and a full export of your data at any time. The rest of the list is a fair thing to ask on a call, and we would rather answer it there in detail than summarise it here.