Keeping your accounting data secure

What is at risk

Your books show who your customers are, what rates they get, your margins, your bank balances and your suppliers. In the wrong hands that is valuable: a departing salesperson can take your dealer list and rates to a competitor; a careless share can expose a customer's statement to another; a compromised PC can lead to fraudulent payments. Security for a small business is mostly about keeping each piece of data with the people who need it.

Passwords and logins

• One person, one login. Never share the owner's or administrator's login with staff. Shared logins make it impossible to know who did what.
• Strong, different passwords for the accounting software, email, banking and the PC itself.
• Two-step sign-in wherever offered, especially for email and online banking.
• Change passwords when someone with access leaves, and when you suspect any leak.
• Do not write passwords on a note stuck to the monitor or in a WhatsApp chat.

Give each role only what it needs

The guide to user roles shows how to set these up step by step.

Protect the accounts PC

• Use a Windows login with a password; lock the screen when away.
• Keep Windows and antivirus updated.
• Do not use the accounts PC for personal browsing, games or downloads.
• Do not plug in unknown pen drives.
• Place the PC where customers and casual visitors cannot see the screen.
• Keep backups as described in backing up accounting data.

Phones are the new risk

Once owners and staff see business data on phones, a lost or shared phone becomes a door into the books. Use an app lock with fingerprint, face or PIN on any business app. Make sure each staff member signs in with their own mobile number, so their access can be removed alone. Avoid saving business PDFs to a phone gallery that syncs with a family account.

Sharing statements safely

Sending ledger statements and invoices on WhatsApp is normal practice, and mistakes happen: the wrong party's statement goes to a customer, or a full outstanding list is forwarded to a group. Simple rules help: share from the party's own record rather than forwarding files, check the name on the PDF before sending, and never send company-wide reports to customer chats.

Watch for payment fraud

A common fraud on businesses is a message that appears to come from a regular supplier, saying their bank account has changed and asking you to pay the next bill to a new account. Another is a fake "urgent" request, seemingly from the owner, asking the accountant to transfer money. Set a firm rule: any change to a supplier's bank details is confirmed by a phone call to a number you already have, not one given in the message. Payments above a set amount need a second person's approval. These two rules cost nothing and stop the most damaging frauds small businesses face.

When someone leaves

1. Remove their login to the accounting software, apps and email on their last day, not later.
2. Change any password they knew, including shared Wi-Fi and the accounts PC.
3. Collect company phones, SIMs and devices.
4. Check recent activity for unusual deletions, rate changes or exports.

Questions to ask any software vendor

• Where is my data stored, and is it encrypted?
• Can I set different roles and limit what each person sees?
• Is there an app lock and a record of who did what?
• Can I remove one person's access instantly?
• Can I export or delete my data if I leave?

Cashflow OS, for example, has roles per company (owner, admin, accountant, staff, salesperson), with salespeople limited to items and their own customers, app lock with fingerprint, face or PIN, QR sign-in for the web app from the phone, and a view of the team's activity for the owner. See team roles.