Data Security in Your Software: The Minimum You Should Demand
Your software holds the most valuable thing the business owns after the till: your customers' data, your prices, your history. And the real threat isn't the movie hacker — it's the password shared on a sticky note, the access of the employee who left a year ago, and the backup nobody ever tested. Security isn't a product you buy: it's practices you demand.
September 21, 20255 min readIn this article
Your software holds the most valuable thing the business owns after the till: your customers' data, your prices and margins, your operations history. A breach charges three times — the operation stopped, customer trust broken, and the legal consequences if personal data was involved — and unlike a physical robbery, you can take months to find out it happened.
The good news against paralysis: you don't need to become a cybersecurity expert. The breaches that hit small businesses almost never come from sophisticated hackers — they come from accumulated neglect, and neglect is fixed with a short list of practices and questions. This guide gives you the real threats, the minimum to demand of any software you use or commission, and the exact questions for your provider.
What exactly is at stake
Run the mental inventory: customers' names, phones and emails; purchase histories and debts; your cost prices and suppliers; banking and invoicing credentials. Each has its buyer in the worst market and its fine in your country's data-protection law. And the biggest cost is rarely the direct one: it's the conversation where you explain to your customers that their data leaked from your business — some commercial relationships don't survive that message.
The real threats (not movie material)
- Credentials stolen by deception: the fake email imitating your bank or supplier that fishes a password from someone on the team — phishing causes more breaches than all technical sophistication combined.
- The access of those who already left: ex-employees and ex-vendors keeping active users — the cheapest breach to prevent and one of the most common.
- Unpatched software: every pending update is a published vulnerability with instructions — automated attacks sweep the internet looking for exactly that.
- Shared and weak passwords: the system key taped to the screen, the panel's "123456", the same password for everything — open doors no firewall compensates.
The minimum to demand of any software of yours
| Front | What to demand | How to verify |
|---|---|---|
| Encryption in transit | Every connection with the padlock (HTTPS) — no exceptions, no "odd" screens | Look at the browser bar; the detail is in the SSL and basic security guide |
| Access and passwords | One user per person, roles by function, two-factor (2FA) on the critical parts | Ask: who can see/delete what? If the answer is "everyone, everything", there's homework |
| Updates | System and dependencies current, with a named owner | Ask when the last update happened — silence is the answer |
| Tested backups | Automatic, stored outside the main system, and test-restored | The full rule is in the backups guide |
The favourite door: the access of those who already left
The questions for your software provider
- Where is the data stored and who can see it?: expected answer: serious cloud provider, encryption, role-restricted access — evasion here is disqualifying.
- How are passwords handled?: the word you want to hear is "hashed" (not even the system itself can read them); the one that should scare you: "we resend it if you forget".
- What happens if there's a breach?: who notifies you, how fast, what gets done — the existence of an answer already tells you they thought about it.
- How is it backed up and how often is restoration tested?: the backup that was never test-restored is a hope, not a backup.
The human half: culture over tools
The best infrastructure loses to one innocent click, so the other half of the job is culture: a password manager for the team (kills repeated passwords and taped notes), fifteen minutes of anti-phishing training (showing three real fake emails teaches more than a manual), and the least-access principle — everyone sees what their job needs, no more; not out of distrust, but because every access removed is attack surface removed. If you're commissioning new software, these demands enter the contract from day one — the full framework is in the app creation guide.
Frequently asked questions
Do I need to hire a cybersecurity expert?
At small-business level, almost never on staff: 90% of the risk is cut by this guide's practices — individual access with 2FA, updates, tested backups, offboarding and anti-phishing — which your own software or IT provider can implement. A one-off external audit makes sense when you handle sensitive data at volume (health, finance) or when a large client demands it as a requirement.
Is the cloud safe, or is keeping everything on my computer safer?
Against intuition: for a small business, the serious cloud is almost always SAFER than your own server — big providers have security teams of hundreds, encryption and backups no small business replicates. The cloud's real risks are yours, not its: weak passwords without 2FA, misconfigured permissions, public shared links. The office computer, meanwhile, gets stolen, burned and infected without notice.
What do I do if I suspect a breach?
In order and without panic: immediately change the affected systems' passwords (and revoke active sessions if the system allows), preserve the evidence (don't delete logs or reinstall yet), call your technical provider to size what was accessed, and if customers' personal data was compromised, check your legal notification duties — many countries have deadlines. What never: hiding it and hoping; breaches discovered by third parties cost double in trust.
How much should I invest in security?
Less than you fear, because the most effective measures are cheap: 2FA is free, a password manager costs a few dollars per person, updates and offboarding are discipline, and backups come included in any decent infrastructure. The right comparison isn't against the IT budget but against the cost of a single incident: a week of stopped operations plus the customers who don't return pays for years of these practices.