← Back to journal

Data security basics for small service businesses

The ServFlo team
Sep 13, 2026
softwareoperations

For a small service business, good data security mostly comes down to a few habits: turn on two-step sign-in for every business account, give each person their own login with only the access they need, never store card numbers yourself, protect customer gate and alarm codes like house keys, and remove access the day someone leaves. Most incidents at small businesses start with a stolen password or a convincing fake email, not a sophisticated hack.

Why would anyone target a small contractor?

It's tempting to think a 6-truck plumbing company isn't worth a criminal's time. But small businesses are attractive precisely because they're less protected, and you hold valuable things:

  • Customers' names, addresses, phone numbers and emails
  • Gate codes, alarm codes and lockbox codes for homes you service
  • Notes about when homes are empty or who lives alone
  • Bank account and payment access
  • Your email account, which can be used to send convincing fake invoices to your own customers

Losing any of these hurts your customers and your reputation. In many states it can also trigger legal notification duties. Breach notification laws vary by state, so ask an attorney what applies to you.

Step 1: Lock down your accounts

Your email, bank, payment processor and field service software are the keys to the business.

  • Turn on two-step sign-in everywhere. A code from an authenticator app, a passkey or a security key stops most stolen-password attacks. Text-message codes are better than nothing.
  • Use a password manager. One strong, unique password per account, generated and remembered for you.
  • Never share logins. Each person gets their own. Shared logins make it impossible to know who did what, or to remove one person's access.
  • Protect the owner's email above all. Password resets for everything else go there.

Step 2: Give people only the access they need

Not everyone needs to see everything.

  • Technicians need their own jobs, the customers on those jobs, and the tools to do the work. They don't need your full customer list, company reports, costs or other people's pay.
  • Dispatchers and office staff need scheduling, customers and invoicing, but maybe not refunds, payroll or company settings.
  • Admins can do almost everything except things like closing the account or managing billing.
  • The owner holds the final keys.

Good software lets you assign roles like these instead of all-or-nothing access. Review who has which role every few months.

Step 3: Never handle card numbers yourself

Don't write card numbers on paper, store them in a spreadsheet or take them over email. Use a payment processor's secure pages or in-person tools, so card details go straight to the processor and never sit in your systems.

If a customer wants to pay by phone, enter the card on the processor's secure page while they read it out, rather than writing it down. Payment card industry rules (PCI DSS) set requirements for anyone handling card data, and keeping card numbers out of your hands is the simplest way to reduce your burden.

Step 4: Treat gate codes like house keys

Access codes are some of the most sensitive data you hold.

  • Store them in your software, attached to the property, not in a group text or a notebook in the truck.
  • Make sure only the tech assigned to the job sees them.
  • Ask customers to change codes after you've finished long projects.
  • Never put codes in marketing emails, review replies or anything public.

Step 5: Plan for lost phones

Field phones get dropped, left on roofs and stolen from trucks.

  • Require a passcode or fingerprint on every phone used for work.
  • Turn on Find My or Find My Device so a lost phone can be located or erased.
  • Use apps that encrypt data stored on the phone, so a found phone doesn't reveal customer details.
  • Know how to sign a device out of your business software from the office.

Step 6: Remove access the day someone leaves

This is the most commonly skipped step. When a technician or office worker leaves:

  1. Remove them from your field service software.
  2. Remove or change access to shared email inboxes, social accounts and supplier portals.
  3. Change any shared codes they knew, like the shop door or a supplier account PIN.
  4. Revoke any API keys or connected apps they set up.
  5. Collect company devices, or confirm business data is removed from personal ones.

Keep a short written checklist so it happens the same way every time.

Step 7: Watch for scams aimed at trades

Common ones:

  • Fake invoices from a "supplier" with new bank details. Always confirm payment changes by phone using a number you already have.
  • Spoofed emails that look like they're from you, sent to your customers with a fake pay link.
  • "Your account will be suspended" messages pointing to fake sign-in pages for your software, bank or Google Business Profile.
  • Overpayment scams: a "customer" overpays by check and asks for the difference back.

Train your office: if a message creates urgency around money or sign-in, slow down and verify through a separate channel.

Step 8: Be careful with connected apps and AI

Every app you connect to your business software, including AI assistants, is another door. Give each one the narrowest access that works, prefer read-only when it's enough, and remove ones you no longer use. See how to use ChatGPT and Claude to run a service business for how to connect AI safely.

Step 9: Keep a record of what happened

An activity log in your software, showing who changed what and when, is invaluable when something goes wrong, whether it's an honest mistake or something worse. Check that your tools keep one.

A one-page checklist

  1. Two-step sign-in on email, bank, payments and field software
  2. A password manager for the team
  3. One login per person, no sharing
  4. Roles with the least access needed
  5. No card numbers on paper or in files
  6. Gate codes stored on the property, visible only to the assigned tech
  7. Passcodes and remote wipe on every work phone
  8. An offboarding checklist used every time
  9. Verify any change to bank details by phone
  10. Review connected apps and API keys quarterly

This post isn't legal advice. Data protection and breach notification rules vary by state and industry; ask an attorney or your insurance agent what applies to you, and ask your insurer whether a cyber policy makes sense.

FAQ

Do I need cyber insurance? Many small businesses consider it. Policies and requirements vary, and some insurers ask about practices like two-step sign-in. Talk to your agent.

Is cloud software safer than files on my computer? Often, because reputable providers handle backups, encryption and security updates you'd otherwise have to manage. It still depends on you protecting your logins.

What should I do if I think we've been hacked? Change the affected passwords from a clean device, turn on two-step sign-in, check for unfamiliar email forwarding rules and connected apps, contact your bank if money is involved, and call an attorney about notification duties.

Should techs use personal phones? It's common. Require a passcode, use apps that encrypt stored data, and make sure you can remove access from the office.

How ServFlo helps

ServFlo gives each person their own login with a role (owner, admin, dispatcher, technician or a read-only member), and technicians see only their own jobs and the customers on them, never your costs or margins. Card payments run on Stripe's secure pages and in-person tools, so card details don't pass through ServFlo. Job data stored on the ServFlo Tech app for offline use is encrypted, an activity log shows who changed what, and API keys can be limited to chosen permissions and revoked at any time. See customers and CRM, payments and the technician app.