BASALT · JOURNAL
Document privacy for nonprofits and small charities
Small organisations handle genuinely sensitive material with none of the infrastructure that larger ones have: no records team, no legal department, and frequently one person doing everything.
What is sensitive here
Donor identities and amounts, particularly where anonymity was requested, which for major donors is common and sometimes a condition of the gift.
Beneficiary records, which in organisations working with vulnerable people are among the most sensitive documents anywhere, covering health, immigration status, housing and safety.
Volunteer records, including background check results.
Board minutes discussing personnel, safeguarding or legal matters.
Where it goes wrong
Grant reporting. Funders ask for evidence of impact and organisations supply case studies containing enough detail to identify a beneficiary, often with a photograph. The consent obtained is frequently vague and rarely covers onward publication by the funder.
Annual reports. Donor lists and beneficiary stories appear in a document published on a website permanently.
Shared drives. Documents accumulate in folders that new volunteers are given broad access to, because managing granular permissions takes time nobody has.
Practical steps that do not need a compliance function
Anonymise case studies properly, which means removing identifying circumstances rather than only the name. In a small community the details identify.
Strip metadata from anything published. Documents produced from a template frequently carry the name of whoever first created it, and photographs carry location.
Keep a separate copy of any document you have redacted, so the unredacted original is not lost.
Check published documents by extracting their text and searching for names, which takes a minute and catches the case where a black box was drawn rather than content removed.
Photographs
The most common nonprofit disclosure is a photograph: of beneficiaries, in an annual report, with location metadata attached, published permanently. Strip image metadata before publishing anything, and check that consent covers the specific use.
This is a description of common practice rather than legal advice. Obligations vary by jurisdiction and by the terms you are working under, and the authority that governs your work is the one to check with.
Frequently asked questions
What documents are sensitive in a nonprofit?
Donor identities and amounts where anonymity was requested, beneficiary records covering health, status, housing and safety, volunteer background checks, and board minutes discussing personnel or safeguarding.
What is the most common nonprofit disclosure mistake?
Case studies in grant reports and annual reports that contain enough circumstantial detail to identify a beneficiary, often accompanied by a photograph, published under consent that did not clearly cover onward publication.
How do I anonymise a case study properly?
Remove identifying circumstances rather than only the name. In a small community the specific details identify the person regardless of whether a name appears.
What should be checked before publishing a document?
Strip metadata, which frequently carries the name of whoever created the template and location data on photographs, then extract the text and search for names to confirm nothing was merely covered rather than removed.
Doing it in Basalt
Basalt is a native macOS PDF toolkit built around redaction that removes content rather than covering it. After writing a file it re-opens its own output with an independent parser, searches for the material again, and refuses to save if anything is found. It also strips metadata, XMP, attachments, embedded scripts and hidden layers as part of the same operation, and a separate Inspector reports what any PDF still hides, including documents Basalt did not create. Everything runs on your Mac: the engine holds no network entitlement at all, which macOS enforces at the code-signature level. A one time $29 licence covers up to three Macs, free for the first 24 hours. basaltformac.com, or brew install --cask chipmunk1101/tap/basalt.
Redaction that proves itself
Basalt destroys the content you mark, then re-opens the file it wrote and proves the content is gone before it saves anything. Your documents never leave your Mac.