Custom Software for NGO & Nonprofit
Secure, flexible, and compliant architecture tailored for the unique challenges of the NGO & Nonprofit sector.
Vivek Mishra — Founder & Lead Architect, ERPStack
Quick Answer
In short: an NGO ERP has to keep a donor restriction intact from gift to expense. ERPStack builds custom nonprofit software on FASB ASC 958 net-asset classes, with functional expense allocation that lands straight in Form 990 Part IX, 2 CFR 200 subaward monitoring, IATI 2.03 publishing, and OFAC SDN screening on every payee.
Why Custom ERP for NGO & Nonprofit?
Operating in the NGO & Nonprofit sector requires a systems architecture designed for high scalability, operational flexibility, and strict regulatory compliance. Standard off-the-shelf software forces your teams to reshape their workflows to fit rigid software packages. A custom ERP for the NGO & Nonprofit industry maps directly to your exact business logic. Deployed to your secure cloud infrastructure (AWS or Azure), the system isolates database schemas, automates redundant reporting tasks, and scales without user seat licensing fees. This ensures your corporate data remains under your absolute control, eliminates vendor lock-in, and lowers long-term operational technology costs by up to 70% over a 3-year period.
Industry Pain Points
- A single-axis general ledger in Oracle NetSuite or Odoo cannot produce the Statement of Functional Expenses that FASB ASC 958 and Form 990 Part IX both demand of an NGO
- Donor restrictions live in spreadsheet tabs beside the CRM, so release-from-restriction becomes a memory exercise at year end
- Indirect cost recovery guessed at instead of applying a NICRA rate or the 15% de minimis of MTDC under 2 CFR 200.414
- Field data captured offline in KoboToolbox or ODK and re-keyed into the NGO ledger weeks later
- Beneficiary records holding names, GPS points and biometrics with no data-minimisation rule and no RBAC in the schema
- Charitable solicitation renewals across dozens of state jurisdictions tracked in a shared calendar rather than in the ERP
Engineering Blueprint
An NGO ledger has two axes, and almost every commercial ERP has one. FASB ASU 2016-14, effective for fiscal years beginning after 15 December 2017, makes each expense report by natural classification and by function at once — so ERPStack builds the PostgreSQL Database around that matrix in TypeScript rather than bolting a second chart of accounts onto Oracle NetSuite, SAP S/4HANA or Odoo.
Natural and functional on one line
Salaries, rent and depreciation are natural classifications; program services, management and general, and fundraising are functions. The Statement of Functional Expenses is that matrix, and the overhead ratio every NGO is judged on falls out of it. ERPStack puts both axes on the posting in Drizzle ORM, with allocation drivers — time-and-effort, square footage, direct identification — as versioned rows validated by Zod, so a restated prior year reproduces. Allocation is a Postgres query, not an unauditable sheet.
// Drizzle ORM on PostgreSQL — ASC 958 needs both axes, always
export const fn = pgEnum('functional_class', [
'program','management_general','fundraising',
]);
export const expenseLines = pgTable('expense_lines', {
naturalAccount: text('natural_account').notNull(), // salaries, rent
functionalClass: fn('functional_class').notNull(),
restricted: boolean('donor_restricted').notNull(),
releaseCondition: text('release_condition'), // null = unrestricted
fain: text('fain'), // federal award id
amount: numeric('amount', { precision: 18, scale: 2 }),
});Restriction is a state, not a note
Since ASU 2016-14 an NGO reports two net asset classes — with and without donor restrictions — and the transition between them is the hard part. ERPStack keeps the restriction, its release condition and the release event on the same PostgreSQL rows the general ledger uses, so a purpose-restricted grant releases when the qualifying expense posts and a capital gift releases on its placed-in-service date. Underwater endowment and liquidity disclosures read from data, and donor CRM records join by API, not CSV.
The award spine every funder audits
Federal money arrives with identity attached: FAIN, Assistance Listing number, period of performance, and per subaward the subrecipient UEI plus a SAM.gov exclusion check under 2 CFR 200.332. Without a NICRA, 200.414(f) permits a de minimis rate of up to 15 percent of modified total direct costs, and 200.414(g) a one-time 4-year extension of a negotiated rate. Because USAID stopped implementing foreign assistance on 1 July 2025 and the Department of State took over its active awards, an NGO needs the award as a versioned PostgreSQL entity — the kind of change a seat-priced SaaS product will not ship for you.
Field data arrives late, and out of order
Enumerators run forms authored as XLSForm — survey and choices worksheets compiled to ODK XForms — in KoboToolbox or ODK Collect, capturing for days without signal. A Next.js and Node.js sync service writes them into PostgreSQL behind a REST API applying Idempotency in API Design on submission UUID, so a re-sent NGO distribution list cannot double-count. Field-office currency is revalued on the transaction, never the report, and the same tables emit IATI 2.03 activity XML for the IATI Registry.
Our Solutions
- Every expense line carries a natural and a functional classification — program, management and general, fundraising — as PostgreSQL columns, never a report mapping
- Net assets with and without donor restrictions modelled in Drizzle ORM, with release conditions and the placed-in-service rule stored as data
- An NGO award spine keyed on FAIN, subrecipient UEI, Assistance Listing number and period of performance, with 2 CFR 200.332 monitoring in the ERP
- Offline-first XLSForm capture syncing into Postgres over an idempotent REST API, with multi-currency FX revaluation per field office
- Beneficiary tables minimised by design, protected by RBAC and AWS envelope encryption, following the ICRC Handbook and the Do No Harm principle
- OFAC SDN and 50 Percent Rule screening fired at vendor creation and at every payment run, logged to an Immutable Audit Trail
Compliance & Security
For an NGO, compliance splits between a tax filing that becomes public and a duty of care to people who cannot walk away. ERPStack treats both as schema decisions, and claims no SOC 2 or ISO 27001 certificate — it builds systems auditable against them.
Beneficiary data, and the limits of consent
The Core Humanitarian Standard 2024 Edition, launched 21 March 2024 with nine commitments, and the Sphere Handbook 2018 set the NGO accountability floor; the ICRC Handbook on Data Protection in Humanitarian Action, third edition 2024, gives biometrics its own chapter because a fingerprint template cannot be reissued after a database is seized. Where registration is the price of food, consent is not freely given, so an NGO records lawful basis per purpose. In the ERP: pseudonymous identifiers, no GPS below settlement level, RBAC per field office, AWS-managed keys, a retention job that runs.Form 990 is a public database, so build for it
Form 990 falls due the 15th day of the 5th month after year end, must be e-filed under the Taxpayer First Act for tax years beginning after 1 July 2019, and 3 consecutive missed years revoke exempt status automatically. Part IX is the functional expense matrix again. Thresholds pick the form: $50,000 gross receipts for 990-N, under $200,000 with assets under $500,000 for 990-EZ, Form 990-PF for foundations. Candid republishes it, so ERPStack generates Part IX from the NGO ledger, not a workbook.Sanctions screening lives in the vendor master
Screening grantees, suppliers and partners against the OFAC SDN List is a legal check, not a policy line, and the 50 Percent Rule blocks entities owned 50 percent or more in aggregate by blocked persons even when unnamed. ERPStack fires screening from a Node.js job at vendor creation and each payment run, writing every hit and clearance to an Immutable Audit Trail in PostgreSQL so the NGO proves what it knew and when.Donor consent, Gift Aid, and the Blackbaud lesson
HMRC pays 25p per £1 on a valid Gift Aid declaration, usually within 5 weeks of a Charities Online claim, so the declaration is a dated record with its own lifecycle — kept apart from marketing consent under UK GDPR and PECR. Blackbaud’s 2020 ransomware breach cost $3 million to the SEC in March 2023, $49.5 million to 50 state attorneys general in October 2023, and an FTC order on 1 February 2024 to delete unneeded data. GDPR Data Compliance for an NGO starts with retaining less: ERPStack ships the deletion job before the donor CRM screens.
Standards we engineer to
- FASB ASC 958 / ASU 2016-14
- 2 CFR 200 Uniform Guidance
- IRS Form 990 & Schedules
- Core Humanitarian Standard 2024
- IATI Standard 2.03
- UK GDPR & PECR
- OFAC SDN screening
Get the Blueprint
Download our comprehensive Systems Architecture Blueprint to see how we architect compliant solutions.
Download BlueprintMetrics & Integrations
Illustrative engineering targets for this sector — the SLAs and capacities we design and build toward, not a live service dashboard.
Functional allocation run, all cost centres
Offline XLSForm capture window
OFAC SDN screening per vendor
Form 990 Part IX export
Integration: KoboToolbox / ODK
Integration: IATI Registry
Integration: OFAC SDN list
Integration: HMRC Charities Online
Integration: Stripe recurring giving
Integration: Candid / GuideStar
Implementation Process
Two-axis chart of accounts
Natural and functional classification on every NGO posting, so the Statement of Functional Expenses is a query.
Restriction and release model
Donor restrictions, release conditions and placed-in-service rules written as Drizzle ORM state, not notes.
Award and subaward spine
FAIN, UEI, Assistance Listing number and period of performance with 2 CFR 200.332 risk assessment in PostgreSQL.
Offline field pipeline
XLSForm capture in KoboToolbox syncing to Postgres on an idempotent, UUID-keyed REST endpoint.
Beneficiary data minimisation
Pseudonymous identifiers, per-purpose lawful basis and RBAC reviewed against the ICRC Handbook.
Filings and disclosure export
Form 990 Part IX, IATI 2.03 activity XML and donor reports generated from the closed NGO ledger.
Proven in NGO & Nonprofit
Field Operations & Compliance Portal
Unified operational portal for field tracking and compliance
Read Case StudyFrequently Asked Questions
Because NGO expense reporting has two axes and a commercial ERP has one. FASB ASU 2016-14 requires every nonprofit to analyse expenses by natural classification — salaries, rent, depreciation — and simultaneously by function: program services, management and general, fundraising. SAP S/4HANA, Oracle NetSuite and Odoo model a single chart of accounts, so the second axis becomes a spreadsheet. ERPStack puts both on the PostgreSQL line item.
Restriction is a state on the gift, not a parallel ledger. Since ASU 2016-14 a nonprofit reports two net asset classes — with and without donor restrictions — so ERPStack stores the restriction, its release condition and the release event on the same Drizzle ORM rows the NGO general ledger uses. Capital gifts release on the placed-in-service date, a comparison PostgreSQL makes, not a year-end memo.
For most US nonprofits under about $20 million, yes, and ERPStack will say so. Blackbaud Financial Edge NXT with Raiser’s Edge NXT, Sage Intacct, Salesforce Nonprofit Cloud and Microsoft Dynamics 365 already carry fund accounting, grants and donor CRM depth no custom NGO ERP should rebuild. Custom work wins where the programme model does not fit a product: multi-country field offices, beneficiary data with real protection duties, donor formats no vendor supports.
Award identity, and therefore your data model. USAID ceased implementing foreign assistance on 1 July 2025 and the Department of State assumed its active awards, so an international nonprofit now holds awards whose administering agency, reporting portal and identifiers changed mid-period-of-performance. ERPStack models the NGO award as a PostgreSQL entity with a history of identifiers rather than one FAIN column, so prior-year reports still reconcile.
$1,000,000 of federal awards expended in a fiscal year, under 2 CFR 200.501. Above it a nonprofit needs a single or program-specific audit, so every ERP transaction carries its Assistance Listing number, FAIN and period of performance, and every subaward records the subrecipient UEI plus a SAM.gov exclusion check under 2 CFR 200.332. Records stay three years from the final financial report under 200.334.
Yes — 2 CFR 200.414(f) lets a nonprofit recipient or subrecipient without a current negotiated rate elect a de minimis rate of up to 15 percent of modified total direct costs. It needs no documentation and may be used indefinitely, but once elected it applies to all federal awards. In the NGO ERP that makes MTDC exclusions a computed PostgreSQL column, because a wrong base is what audit findings are made of.
By storing less of it. The ICRC Handbook on Data Protection in Humanitarian Action, third edition 2024, gives biometrics a full chapter precisely because a fingerprint template cannot be reissued once a database is seized. ERPStack applies Do No Harm at schema level for NGO and nonprofit programmes: pseudonymous beneficiary identifiers, no GPS below settlement level by default, RBAC scoped to one field office, and AWS-managed keys.
Usually not, and pretending otherwise is the common design error. Where an NGO requires registration before someone receives food or shelter, consent is not freely given, so the nonprofit relies on vital interests, public interest or legitimate interests instead. The ERP consequence is concrete: no consent-checkbox theatre, but a recorded lawful basis per processing purpose, a retention clock, and a real objection path. GDPR still covers staff and donor data.
Through XLSForm and a reconciliation queue, not a live connection. Enumerators run forms authored as XLSForm — survey and choices worksheets compiled to ODK XForms — in KoboToolbox or ODK Collect, capturing for days without signal. ERPStack syncs submissions into the nonprofit PostgreSQL ledger behind a REST API made idempotent on submission UUID, so a re-sent NGO distribution list cannot double-count a beneficiary.
Many institutional donors require it. IATI Standard version 2.03 expects an activity file of XML published to the IATI Registry, where each iati-identifier is your organisation identifier plus an internal activity ID. For an NGO that is an export, not a portal: ERPStack generates the activity XML from the same award, budget and transaction tables in PostgreSQL that the nonprofit finance team already closes, so published and audited figures cannot diverge.
As a dated declaration attached to the donor, not a tick on a form. HMRC lets a UK charity, nonprofit or CASC reclaim 25p for every £1 an eligible individual gives, but only against a valid Gift Aid declaration, and a Charities Online claim is typically paid within 5 weeks. In a custom NGO CRM the declaration has its own lifecycle, and marketing consent under UK GDPR and PECR is a separate record.