This page is optimised for desktop viewing.

For mobile, please rotate to landscape.

StrongKeep Charity brief 2026

Cybersecurity
for charities,
made simple.

Singapore-built. PDPA and NCSS Essentials ready. No IT team needed.

strongkeep.com Plans from $39/month · Live in under an hour
SK · 2026
The risks

The risks every charity faces.

CIA 01
Confidentiality
Donor and beneficiary data leaks.
Donor names, giving histories, beneficiary case files, volunteer personal data. Information your stakeholders trusted only with you, now exposed or traded.
CIA 02
Integrity
Records altered, bank details changed.
Business email compromise targets payment details. Beneficiary records get altered. The data still loads but it is no longer true, and funds go to the wrong account.
CIA 03
Availability
Systems locked by ransomware.
Programme delivery halted. Donor data frozen. Volunteer records inaccessible. Ransomware does not spare charities; attackers know smaller organisations are less defended.
UK DCMS · 2019
22%of charities hit
22% of UK charities identified a cyber breach or attack in the last 12 months. Charities are not exempt from the threat landscape.
CSA Singapore · 2018
16,100phishing URLs
16,100 phishing URLs with a Singapore nexus detected in 2018. Staff and volunteers clicking phishing links is the most common breach entry point.
CSA Singapore · 2018
6,179cybercrime cases
6,179 cybercrime cases reported in Singapore in 2018. Scams, ransomware and phishing affected organisations of all sizes across all sectors.
Sources: UK DCMS Cyber Security Breaches Survey 2019 · CSA Singapore Cyber Landscape 2018
02 / 17
Compliance

PDPA applies to charities. Every one of them.

PDPA (Act No. 26 of 2012)
Applies to all organisations, including charities
9 Obligations: Consent, Purpose Limitation, Notification, Access and Correction, Accuracy, Protection (s.24), Retention Limitation, Transfer Limitation, Accountability. Must appoint a Data Protection Officer.
Charities Act
Donor confidentiality and sector guidance
Subsidiary legislation requires donor information kept confidential. Commissioner of Charities' Data Protection Guide provides sector-specific guidance for charities.
NCSS Cybersecurity Essentials
Charity sector cyber baseline
"Cybersecurity Essentials for Social Service Agencies and Charities" sets the sector baseline for cyber hygiene across Singapore's charity and social service sector.
Sources

Commissioner of Charities -- Data Protection Guide for Charities (charities.gov.sg) · NCSS -- Cybersecurity Essentials for Social Service Agencies and Charities (file.go.gov.sg/csess.pdf)

03 / 17
Anti-objection

Donor databases and free tools are not enough.

What you rely on
Donor databases and free cloud tools.
  • Donor databases
  • Free cloud accounts (Gmail, Dropbox)
  • Shared office PCs
  • Volunteers on personal devices
  • No dedicated IT person
What that leaves exposed
Every gap around those tools.
  • Weak or shared passwords across accounts
  • Personal devices with no malware protection
  • Phishing emails targeting staff and volunteers
  • Unencrypted donor data sent by email or WhatsApp
  • No way to detect a breach until it is too late
Under PDPA, you are responsible for the data, regardless of what tools you use.
04 / 17
How it works

Three steps. No IT team needed.

The NCSS Cybersecurity Essentials model gives charities a clear path. PDPA's Protection Obligation (s.24) requires reasonable security arrangements, and encryption is almost always necessary.

Step 1
Create an IT asset inventory
  • Know every device used by staff and volunteers
  • Know where donor and beneficiary data is stored
  • Identify which cloud services and apps hold personal data
Step 2
Secure, detect, respond and recover
  • Technical measures: anti-malware, DNS firewall, encryption
  • Process measures: policies, incident response plan
  • People measures: training, phishing awareness
Step 3
Put measures into practice
  • Deploy protection to every device
  • Run staff and volunteer training
  • Keep evidence of your measures for PDPA accountability
PDPA s.24

Organisations must protect personal data in their possession or under their control by making reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks.

05 / 17
Our approach

We re-engineered cyber for charities.

01 Affordable
Like IKEA.
"Custom carpentry > IKEA. But IKEA > not having a table at all."
Re-engineered to cost.
Cyber is over-engineered. We redesigned the pieces so a small charity can afford them. Plans from $39/month.
02 Comprehensive
Like Xero.
Same shift accounting and project management already went through.
Bundled and productised.
Cyber tools are fragmented. We bundled what a charity needs into one platform: anti-malware, DNS firewall, training, password manager, compliance automation.
03 Simple
Like toilets.
No one cares how the toilet works. They just want it to flush.
Built for non-techies.
Cyber tools are built for security pros. We hid the complexity so a programme director or ops manager can deploy it themselves, no IT team required.
98% Microsoft research: getting the basics of cybersecurity right stops 98% of attacks. The NCSS Essentials and PDPA are asking for those basics, nothing exotic.
06 / 17
The product

Five protections. One dashboard.

Pre-bundled. Powered by Palo Alto Cortex and A*STAR cyber research.

01
Devices
Endpoint detection and response
Palo Alto Cortex XDR stops malware and ransomware on every staff and volunteer device in real time.
02
Network and browsers
DNS firewall
ControlD blocks phishing links, fake websites and bad links in scam messages the moment anyone clicks.
03
Compliance
Compliance automation
Maps NCSS Essentials and PDPA obligations into evidence and clause mapping. Cyber Essentials and Data Privacy Essentials certifications supported.
04
People
Security awareness training
Phishing and scam-spotting lessons for staff and volunteers. Builds habits without classroom sessions.
05
Passwords
Password manager
Bitwarden keeps passwords strong and unique across every account. Supports MFA. Also covers backups, audit logs, and asset visibility from one owner dashboard.
Dashboard
Employee Risk Overview See all
Programme staff 4 Admin 6 Volunteers 3
Name Grade Training Device Passwords Recommendation
Director Chen A 99% No alerts No alerts All clear!
Staff Priya B 81% 3 blocked sites 1 reused password Training: Phishing Sites
Volunteer Jay C 74% 1 malware 3 weak passwords Reduced Access
Your whole team's posture, staff and volunteers together. Focus on the riskiest people; leave the safe ones to do their work.
07 / 17
Deployment

Simple enough for anyone.

Redesigning cybersecurity to be easy to deploy and use was the hardest part.

Fastest onboarding on record
7minutes
That's how quickly one customer self-onboarded and got their protection going.
Live in under an hour.
1
Scan your organisation
Free email and website scans. Find the gaps before attackers do.
2
Deploy protection to your team
One-click M365 or Google integration. We push device protection to every staff laptop and phone.
3
Set up password protection
Centralised password manager and 2FA. No more shared passwords on sticky notes.
4
Set up training
Bite-sized awareness lessons and simulated phishing drills for staff and volunteers.
08 / 17
Compliance

PDPA compliance in days. Not months.

Auto-generate policies. Auto-collect evidence. Track every PDPA obligation and NCSS control from one screen. Most of the work is invisible, the controls deploy themselves with your protection.

  • CSA Cyber Essentials -- Singapore cyber baseline, with certification path
  • Data Privacy Essentials -- PDPA-aligned, maps all 9 obligations
  • NCSS Cybersecurity Essentials -- charity and social service sector baseline
  • Data breach readiness -- PDPC Guide to Managing Data Breaches; report to SingCERT within 3 days of confirmed notifiable breach
Why this matters. Under PDPA you must be able to demonstrate your Protection Obligation (s.24) is met. We bake the evidence in as you go, with policies, logs, training records and asset register.
Sources: PDPC Guide to Managing Data Breaches · CSA SingCERT incident reporting
PDPA compliance
12 of 17 controls in place
71% completeReady to demonstrate
Asset register (devices and data)Complete
Password manager and MFAComplete
Anti-malware on all devicesComplete
Staff phishing awareness trainingIn progress
Data classification and handlingGenerating
Incident response planPending approval
09 / 17
Customer proof

Real organisations. Real results.

A specialist practice in Singapore protecting sensitive patient data. Needed protection beyond consumer antivirus, deployable without clinic IT.
Dr Harish at Neumark Surgery
Dr Harish
Doctor · Neumark Surgery
"The setup was straightforward and caused no disruption to our operations. No technical expertise was required. It simply worked."
Read full case study →
A Singapore VC firm safeguarding sensitive investor and portfolio data. Their previous enterprise vendor required 1,000+ seats and dropped them. They needed something a one-person team could run.
Ling, IT Manager at Integra Partners
Ling
IT Manager · Integra Partners
"We don't have an IT department. I'm the one who deals with laptops, systems, and making sure everyone's devices are working. I needed something I could manage myself."
Read full case study →
An SMB that needed Cyber Essentials certification to keep a major contract. From zero to compliant in 8 days, run by Chee Keong himself.
Chee Keong, Sales Manager at AZAntz
Chee Keong
Sales Manager · AZAntz
"With StrongKeep's plan at $159 a month, we got both the compliance and the tools in one package."
Read full case study →
10 / 17
Partnerships

Partnered with companies you know.

Built with leading organisations who share our mission to secure smaller organisations worldwide.

Digital Capital Collective (DCC, formerly iShine Cloud, rebranded 1 April 2026) -- digital enabler for Singapore's charity sector. StrongKeep offered as a member benefit for DCC members.
11 / 17
We run a charity too

We understand charities because we run one too.

Gaurav co-founded and ran the largest TechForGood charity, Better.sg. He has built and run technology for the charity sector for over 20 years, and StrongKeep protects his own charity.

Managing 3000+ volunteers
Better.sg volunteers at Beacon 2025
Handling sensitive partner data
Supporting social impact organisations
12 / 17
In the media

Featured in the media you read.

StrongKeep is a thought leader and advocate for SMB cybersecurity globally.

The Straits Times
"Think you're safe from cyber crooks? Why 99% of companies are exposed."

Plus opinion features on cyber piranhas (Oct 2025) and ransomware reporting (Jul 2025). Three Straits Times pieces in twelve months.
Straits Times: 99% of companies are exposed
Channel News Asia
"Leaked documents suggest 255 Singapore firms linked to critical infrastructure hit."
CNA: Leaked documents
TechInAsia
"A startup trying to IKEA-ify cybersecurity for SMEs."
TechInAsia: IKEA-ify cybersecurity
Dark Reading
"Addressing the supply chain risk -- why protecting smaller companies matters."
Dark Reading: Supply chain risk
Bank InfoSecurity
"The Great Cyber Divide" -- CEO on the security gap between large and small enterprises.
Bank InfoSecurity: The Great Cyber Divide
13 / 17
The team

Built by people who ran national cybersecurity, served small businesses, and live in deep-tech.

Gaurav Keerthi
BG(NS) Gaurav Keerthi
Founder & CEO
Former Deputy Commissioner, Cyber Security Agency of Singapore; CIO of Republic of Singapore Air Force; UN Cyber Expert. 20+ years in cyber, defence, and public-sector leadership.
Zaishao Cheng
Zaishao Cheng
Co-founder & COO
Product, engineering, operations. Former Temasek cyber investment lead. Former startup founder.
Clement Chai
Clement Chai
PM
Engineering and platform leadership. Formerly Singtel, led development of SaaS for 3000 SMBs.
Deep R&D

Agentic vCISO: a US$1M government-backed R&D grant.

StrongKeep is partnered with Singapore's A*STAR on a 7-figure cybersecurity R&D programme.

Research collaborators · A*STAR
Dr Dinil Mon Divakaran · Principal Investigator (network, AI, systems)
Dr Levente Csikor · Principal Investigator (next-gen security)
Dr Jehyun Lee · Senior Principal Scientist
Dr Kohli Varun · Senior Scientist
Dr Hao Anran · NLP, deep learning
14 / 17
Pricing

Plans start from $39/month.

Pay-as-you-grow. No long-term lock-in. DCC members get 25% off with member code DCC2026.

Protection
$39/ month
~$29.25 with code DCC2026
Covers 5 devices. Add devices at $5.50/month each.
Includes:
  • Endpoint detection and response (EDR)
  • DNS firewall
  • Password manager and 2FA
  • Awareness training
  • Unified dashboard
Compliance
$159 / month (~$119.25 with DCC2026)
Everything in Protection, plus:
  • Automated policies and evidence collection
  • CSA Cyber Essentials submission support
  • PDPA compliance mapping
Resilience
From $999 / month
For larger charities and regulated workloads:
  • 24/7 incident response
  • Continuous VAPT scanning
  • Dedicated customer success
Add-ons
Cyber insurance and incident-response retainers from just a few dollars per device per month.
Insurance Incident response
DCC member benefit: 25% off Protection and Compliance base plans with code DCC2026. No long contract required. Start on Protection, upgrade to Compliance when working towards certification.
15 / 17
StrongKeep for charities, through DCC

Five vendors to secure your charity, or one box that just works.

Piece it together yourself
5 renewals
out of sync
Antivirus
separate vendor
Web filter
separate vendor
Password manager
separate vendor
Staff training
separate vendor
Phishing tests
separate vendor
4–5 billsto track and renew each year, from vendors that don't talk to each other.
StrongKeep: security in a box
One platform, five protections
Your team runs it all from a single dashboard
Antivirus & device protection
Included
Web filter that blocks harmful sites
Included
Password manager
Included
Quiz-based staff training
Included
Phishing tests for staff
Included
1 billOne dashboard, one subscription, one security grade you can see at a glance.
US$29.25/mo
with the 25% DCC charity rate — all five protections, up to 5 devices
25%
off the US$39 list price for charities that come through DCC
~50%
less than buying comparable tools separately, with the DCC rate applied
DCC charity programme
Ask DCC for the charity code
Brought to you by DCC and StrongKeep The Digital Capital Collective Prices in US dollars. Covers up to 5 devices — if you need more, ask DCC.
16 / 17
Start protecting your charity today.

The data is yours to protect.
Attackers aren't waiting.

Get a free scan of your organisation today. Most charities are live in under an hour.

Start with a Free Scan → Book a Demo
strongkeep.com [email protected]
17 / 17