For groups & communities
Keep your members’ details, and your group, safe.
Clubs, community groups and not-for-profits hold more personal information than anyone realises, usually spread across volunteers’ phones and inboxes. A few shared habits keep it safe, and make every handover easy.
Free, easy-to-follow steps · for clubs, groups and not-for-profits · help there if you want it
Why it matters
A group holds more about its members than anyone realises.
Names, phone numbers and addresses end up spread across a shared inbox, a spreadsheet, a group chat and someone’s personal phone.
When a volunteer moves on, the logins and the member list can go with them, or stay somewhere nobody checks. And the Australian Signals Directorate names phishing, fake payment requests and ransomware as the key threats to charities and not-for-profits.
Sound familiar?
- The group chat runs on whatever app everyone already had.
- Only one person knows the password to the website, or the bank.
- The member list lives in someone’s personal spreadsheet.
- Nobody is sure who can still open the shared drive.
$166.8 million
reported lost in 2025 to payment redirection scams: fake invoices and changed bank details, the kind treasurers are sent
Source: National Anti-Scam Centre, 2026
Every 6 minutes
on average, someone reported a cybercrime to the Australian Signals Directorate in 2024–25
Source: ASD Cyber Threat Report 2024–25
The good news: A few shared habits and the right tools keep a group’s information with the group, and make every handover easy.
What to do
The group essentials, in the order that matters.
Nine steps a committee can work through together. The first three protect the group’s money and its main accounts, and fit in one meeting. Open each one for how to do it, and tick it off when it’s done.
Tick “Done” as you finish each step. Ticks stay on this screen: nothing is sent, and they clear when you leave.
This week One committee meeting
Layer 7 · Identity & sign-in
Two-step sign-in on the group’s email and bank
The group’s email can reset every other account, and its bank holds members’ money.
How to do it
- Turn on two-step sign-in for the group’s email, bank, website and social media accounts.
- Make sure two trusted people can get into each one, so nothing depends on a single volunteer.
People & habits
Write a list of the group’s accounts
You can’t hand over, or lock down, accounts nobody knows about.
How to do it
- List every account the group has, who can get in, and who pays for it. Not the passwords themselves.
- Keep it with the committee, and update it whenever someone’s role changes.
Layer 8 · Financial privacy
Check payment requests by phone
Fake invoices, and “urgent” emails that look like they’re from the chair, are sent to treasurers.
How to do it
- Before paying a new or changed bank account, call the person on a number you already have.
- Agree that no payment is ever rushed because of an email or message alone.
Cyber security for charities and not-for-profits (cyber.gov.au)
This month A working bee or two
Layer 7 · Identity & sign-in
A shared password manager
Passwords sent by text or kept in a spreadsheet are easy to lose track of, and hard to take back.
How to do it
- Set up a password manager with a shared vault for the group’s accounts.
- Give each role access to what it needs, and remove people when they step down.
Your members
Member details in one safe place
Details spread across personal phones and spreadsheets can’t be protected, corrected or cleaned up.
How to do it
- Choose one place for the member list, open only to the roles that need it.
- Collect only what the group uses, and ask members before sharing their details with anyone.
- Delete old copies from personal devices and inboxes.
People & habits
A handover checklist
Handovers are when access gets lost, or stays with someone who has left.
How to do it
- When a role changes, pass on access through the password manager and change any shared passwords.
- Transfer admin rights on the website, social media pages and group chats, then remove the old volunteer.
When you’re ready At the group’s pace
Layer 4 · Communications
A group chat the group controls
Chats on personal accounts mix members’ numbers with everything else, and their admins move on.
How to do it
- Use Signal for group chats, with more than one admin, and new members approved by an admin.
- Agree what’s never posted there, such as members’ addresses.
Layer 6 · Storage & encryption
Backups of the group’s records
Minutes, accounts and photos should outlive any one laptop, or any one volunteer.
How to do it
- Keep records in a shared space the group controls, with a second copy kept offline by another member.
- Once a year, check you can open the backup.
Your members
A short privacy note for members
Telling members what you collect and why builds trust, and shows you what you don’t need.
How to do it
- Write a few lines: what you collect, why, who can see it, and how to ask for changes.
- Put it on your membership form and your website.
Free tools
Free tools for a volunteer group.
From PAN, and from the government services whose job is keeping Australians safe online.
Free · PAN
The privacy check
Answer it for the group rather than yourself: where it stands across nine layers, and the first three steps.
Free · Australian Government
For charities and not-for-profits
The Australian Signals Directorate’s key threats, top tips and a free checklist.
Free · Australian Government
Cyber health check
A basic, anonymous security check for not-for-profits, in under five minutes.
Free · PAN
The community scale
Why privacy works best shared, in households and local communities.
Free · PAN
Your digital footprint
What a stranger could find about you, and about the people who run the group.
Free · PAN
Help now
Something’s already gone wrong? Calm first steps, in order, and who to call.
Beyond the screen
Doing things together, face to face?
PAN looks after the digital side of a group. Gatherings, skill shares, community gardens and local resilience belong to the Local Action Network, PAN’s sister network, which is launching now. LAN builds the community; PAN protects how it talks.
In the framework, this is the community scale and the self-reliance layers. Tick the box in the form below and I’ll tell you when the first gathering is set.
Help if you want it
Rather have a hand with it? Help is here when you want it.
Everything above can be done by the group. If you’d rather someone set it up with the committee, or build the group a home online, that’s what I do.
Websites
A private, fast website for events, news and sign-ups, that the group can update itself.
Secure devices & accounts
A shared password manager, two-step sign-in, and clean handovers when volunteers change.
Privacy audits
A clear look at where members’ details live and who can see them, with the fixes in order.
Tech support
Someone to call for computers, phones, Wi-Fi and the odd emergency.
Clubs, community groups and not-for-profits · remote anywhere · on-site in Gippsland · a plan and a quote first
Good to know
Questions people ask
Something else on your mind? Ask it in the form below. Every enquiry gets a personal reply.
We’re all volunteers. What’s the least we should do?
Two-step sign-in on the group’s email and bank, with two people able to get into each, and a list of the group’s accounts. That covers the worst problems.
Can we move off a Facebook group?
Yes, when the group is ready. Signal groups and a simple website can take over most of what it does. Keep the old group going until everyone has moved.
What happens when a volunteer leaves?
With a shared password manager and a handover checklist, access passes to the next person and is removed from the last, without passwords sent around.
Is this the Local Action Network?
No. PAN helps with the group’s tech and privacy. The Local Action Network is PAN’s sister network, for doing things together locally: gatherings, skill shares and neighbours who know each other again. It’s launching now.
Can you help with any of this?
Yes: clubs, community groups and not-for-profits, remote anywhere or on-site in Gippsland, with a plan and a quote before anything starts.
Questions, or want a hand?
Ask a question, or tell me about your group and what it needs. Every enquiry gets a personal reply.