Case management software for nonprofits.
What it must do, and how to choose

Plenty of tools can store a client record. Far fewer can flag overdue safety actions, stop a volunteer reading a survivor's narrative notes, keep working when an outreach worker loses signal, and still produce a clean funder report. This guide covers what to look for, how the main platforms compare in 2026, and when a Zoho Creator build beats an off-the-shelf product (and when it doesn't).

Case management is the structured way a caseworker, counsellor, social worker or field worker supports one person towards an agreed goal, over weeks, months or years. Software makes that journey visible and accountable.

The Inter-Agency Guidelines for Case Management and Child Protection (Child Protection Working Group, 2014) set out six steps that translate well to almost any service:

Case management vs beneficiary management: which do you need?

We get this question in almost every discovery call.

• Case management is depth on one person: plans, notes, decisions and referrals. Typical caseloads are tens of people per worker, not thousands.
• Beneficiary management is breadth across many people: a registry with unique IDs, eligibility, programme enrolment and attendance at scale. Think 40,000 students across a state.

Many organisations need both: a registry for every child, with a case workflow only for children flagged for protection concerns. Read our beneficiary management system guide next to this one, and see how both fit inside a wider management information system (MIS) for nonprofits. If you haven't yet agreed what outcomes the case work is meant to change, start one step earlier with our Theory of Change to data model guide.

The six stages hold everywhere. The records, roles and red lines do not.

• Child protection. Separate records for allegations and findings, a safety plan with named owners, need-to-know access to narrative notes, and partner referrals that are confirmed, not just sent. Software should never automate a best-interest determination, a placement or a closure.
• Domestic violence, GBV and legal aid. Contact details can be dangerous, so build "safe contact" fields and keep legal matter records separate from counselling notes. US victim service providers funded under VAWA are generally barred from entering client-identifying information into a community HMIS and use a comparable database instead. See our access to justice and gender equality playbooks.
• Disability inclusion. The central record is a person-centred plan of barriers, goals and accommodations. Our disability inclusion case management guide has the record set.
• Homelessness and housing. In the US, HUD Continuum of Care programmes report through the community's HMIS against HUD's HMIS Data Standards, updated again for FY2026 (example state guidance). That rule often decides the software for you.
• Community health. Caseloads are households. You need visit schedules, screening results with the protocol version, facility referrals with due dates and confirmation that the service was received. See our community health worker case management guide.

These are the ones we test for in every evaluation, grouped by the problem they solve.

• Getting people in cleanly: one intake structure across web, phone, walk-in and partner referral; duplicate checks before a record is created; consent captured at intake with the consent text version and date.
• Running the case: a case plan with goals, actions, owners and due dates; categorised case notes (so "sensitive narrative" can be restricted separately from "service delivered"); a referral loop of sent, accepted, service received, closed; overdue alerts; caseload views per worker and supervisor.
• Keeping it safe: role-based access down to field and note-type level; an audit trail of views, edits and exports; logged export controls; closure approval and a retention rule per record type.
• Working in the field: offline mobile forms that sync safely, local languages, location capture only where it serves a purpose.
• Proving it worked: outcome measures defined once; supervisor views (what's overdue) separate from funder views (what changed); clean export to your M&E system or accounting.

This is the part most vendor pages skim, and the one that causes real harm when it's wrong. Start from least access: a caseworker sees their own caseload, a supervisor their team, a partner agency only the referral it received. Record which version of your consent text each person agreed to, and make withdrawal visible. Flag risk fast, but never turn it into an automatic score people treat as a decision: the system prepares the evidence, a named person owns the judgement.

Regulation sharpens this. In the US, check HIPAA, CoC HMIS rules and VAWA or VOCA terms. In the UK, health, ethnicity and religion are special category data needing an Article 9 condition (ICO guidance). In India, the DPDP Rules, 2025 bring the main duties, including children's data, into force around 13 May 2027 (summary). Our DPDP compliance checklist for NGOs turns that into steps, and if you hold children's records, read our guide to verifiable parental consent under DPDP. Our ZolaShield team helps nonprofits get ready.

Take Zoho Creator, which we build on most. Its offline mode works on Android and iOS across all plans, but mandatory-field and no-duplicate checks don't run offline, and signing out clears unsynced entries. So we move duplicate checks to a supervisor queue after sync and put "sync before you sign out" into training.

Ask every vendor: what validation is skipped offline, what happens to unsynced data on sign-out, and can a lost device be wiped remotely? Our guide to offline sync conflicts and how to prevent them goes further.

Everything below was checked against vendor pages in November 2026. Where a vendor doesn't publish prices, we say so rather than guess.

When an off-the-shelf product is the better choice

We build on Zoho, and we will still tell you to buy something else when:

• You report into a US CoC HMIS. Use your community's HMIS, or a product with proven HMIS export.
• You're in the Citizens Advice network or a similar federation. Use the network's system (Casebook).
• You run inter-agency humanitarian child protection or GBV work. Primero is free to license, and your coordination group probably already uses it.
• You need clinical scheduling and insurance billing. That's an EHR or Penelope.
• You're a team of five with a standard US intake-to-referral flow. CharityTracker will cost less than any build and be live in a week.

A build makes sense when several programmes need one person record, when you work in India or other LMICs where US-centred tools don't fit language, cost or data rules, or when case management must connect to fundraising, HR and finance. Start with how we think about Zoho for nonprofits.

One of our current projects is with a US legal services nonprofit that represents victims of crime. People reached it through an online survey and a PDF referral form, and staff re-typed both into a spreadsheet that had become the case file.

We started with one Zoho Forms intake, designed after reviewing every question on both routes, feeding a Zoho Creator screen where staff review and route each new matter. Migration and dashboards were planned next; once intake worked, the team chose to hold dashboards until their reporting needs settled.

The lessons travel. Intake is the cheapest place to fix data quality. And dashboards built before anyone agrees what a "case" or an "outcome" is tend to get rebuilt. The project is still in final sign-off, so we're not quoting time-saved figures. We'd rather show you proof than promises.

1. Map one typical and one hard case end to end.
2. Write your access matrix. Who sees what, who approves closure, who can export.
3. List your reporting obligations. Funders, government, HMIS, courts, CSR partners. Define outcomes now, because intake and assessment are where the baseline gets captured; connect to your M&E software rather than rebuilding indicators twice.
4. Test two or three options with real cases, run by a caseworker and a supervisor.
5. Price the full five years: licences, implementation, migration, training and support.

In India or another LMIC, add one step: check language support and whether per-user pricing still works as you grow.