Technology, Accounts & Cybersecurity

1. 1

   Accounts and admins

   Make a list of every account the business uses, from email and banking to the website host, domain registrar, Google Business Profile, accounting and social media. For each one, write down the sign-in email, who is the main owner and who else has admin access.

   Sign every account up under a business email you control, not a personal address or a vendor's address. Keep at least two admins on the accounts that matter most, so one person leaving or getting sick does not lock the business out. Give everyone else the lowest level of access that lets them do their job.

   • List every account the business uses
   • Move sign-ins to a business email you own
   • Add a second trusted admin to key accounts
   • Cut access down to what each person needs
2. 2

   Passwords and sign‑in

   Use a password manager so every account gets a long, unique password that nobody has to remember. Bitwarden, 1Password and the managers built into Apple and Google devices all work. Share logins through the manager, never by text or sticky note.

   Turn on two-step sign-in, also called multi-factor authentication, on email, banking, payroll, the domain registrar and your website. Passkeys and security keys are the safest choice because they resist phishing, and an authenticator app is safer than a text message code. Write down where the backup codes are kept, because losing your phone without them can mean days of trouble getting back in.

   • Set up a business password manager
   • Replace reused passwords with unique ones
   • Use passkeys or two-step sign‑in everywhere
   • Store backup codes in a safe place
3. 3

   Customer data

   Collect only the customer information you actually use, and know where each piece lives. Names, addresses, phone numbers and job notes usually sit in a CRM or job software. Card numbers should stay with your payment processor, never in a spreadsheet or email.

   Keep customer files in business accounts with two-step sign-in turned on, not on a personal laptop or in a crew member's phone. Shred paper with personal details. Delete old records you no longer need, after checking with your accountant how long tax and job records must be kept.

   • Map where customer data is stored
   • Keep card numbers with the payment processor
   • Lock files behind business accounts
   • Delete records you no longer need
4. 4

   Privacy requests and breaches

   Post a plain privacy policy on your website that says what you collect, why, and how a customer can ask you to see or delete it. Some states give customers formal privacy rights, and the rules depend on the state and the size of the business, so check what applies to you.

   Plan now for a breach, such as a hacked email or a stolen laptop. Write down who to call, how to lock accounts and how to tell affected customers. Every state has its own breach notice law with its own timing, so bring in an attorney fast if customer data may have been exposed.

   • Publish a plain privacy policy on the site
   • Set a simple way to handle privacy requests
   • Write a one-page breach response plan
   • Keep your attorney's number in that plan
5. 5

   When people leave

   Remove access the same day an employee, contractor or vendor stops working with you. Use your account list to turn off their email, remove them as an admin, change any shared passwords and collect company devices, keys and cards.

   Forward the departed person's email to a manager so customer messages are not lost, and keep their files in the business account. Check the Google Business Profile, website, social pages and domain registrar too, because a former helper often stays an owner there for years without anyone noticing.

   • Turn off access on the last day
   • Change any passwords they knew
   • Forward their email to a manager
   • Collect devices, keys and company cards
6. 6

   Backups and emergency access

   Back up the things you cannot rebuild, such as email, accounting files, customer records, photos, contracts and the website. Keep at least one copy in a separate place from the original, such as a cloud backup service plus an external drive kept offsite.

   Test a restore a few times a year by pulling back a real file or a copy of the website. Then set up emergency access so a spouse, partner or trusted person can reach the password manager and key accounts if something happens to you. Most password managers have an emergency access feature built in.

   • List the data you cannot afford to lose
   • Keep one backup copy in a separate place
   • Test a restore on a regular schedule
   • Name a trusted person for emergency access

General information only, not legal, tax or financial advice. See the Disclaimer.