Security basics for a small-business admin system

Small business CRM security comes down to a short list: everyone has their own login, logins lock after repeated failed attempts, every change is logged, backups run nightly and can actually be restored, and nobody who has left the business still has access. None of it is exotic, and most of it is habit rather than technology.

The risks we worry about most at small firms are ordinary ones: a shared password on a sticky note, a former employee who can still log in, or a backup nobody has ever tested. Here is how to close those gaps.

Why does a small-business CRM need security at all?

Your admin system holds customer names, phone numbers, addresses, quotes and invoices. That is personal information, and in Canada the business that collects it is responsible for protecting it.

The Office of the Privacy Commissioner of Canada explains the rules businesses follow under federal privacy law. You do not need to be a lawyer to meet the basics, but you do need to take them seriously.

There is also the plain business risk. If your customer list and job history disappeared tomorrow, how long would it take to rebuild?

One person, one login

Shared logins are a classic weak point in a small office. When five people use the same password, you cannot tell who did what, and you cannot remove one person without changing it for everyone.

Give every staff member their own login. Then give each person only the access their job needs: the front desk may not need the ledger, and a part-timer may not need to export the whole customer list.

Lock the door after repeated failures

Anyone can guess at a login page. A lockout after several failed attempts makes guessing slow and noisy instead of quick and quiet.

Pair that with sensible passwords: long, unique to this system, and stored in a password manager rather than a notebook. Turn on two-step verification on the accounts around your CRM too, especially your Gmail and your hosting account, because enquiries often flow in through email.

Keep an audit log

An audit log records who changed what, and when. It is less about catching villains and more about answering everyday questions.

• Who changed this customer's phone number?
• Who marked this invoice as paid?
• When was this job's cost updated, and from what?

When something looks wrong, the log turns a guessing game into a two-minute check.

Backups you have actually tested

Nightly backups are the floor, not the ceiling. A backup that has never been restored is a hope, not a plan.

• Back up automatically every night, without anyone having to remember
• Keep backups somewhere separate from the live system
• Test a restore now and then, so you know it works before you need it
• Export your own copy of key data occasionally

No secrets in the browser, and HTTPS everywhere

Website and app code that runs in a visitor's browser can be read by anyone who opens the developer tools. API keys and passwords should never sit there.

Every page of the system should load over HTTPS, so logins and customer data are encrypted in transit. Both are items on the pre-launch checklist we run for every site we build.

Own the account, not just the data

Where your system runs matters as much as how it is built. If it lives on a vendor's account, your access depends on that relationship staying friendly.

Running it on a hosting account in your business's name means you can change providers and keep everything. We went through that trade-off in own vs rent business software.

A simple offboarding checklist

When someone leaves, do this the same day:

• Disable their login to the admin system
• Remove them from the Gmail or Workspace account and any shared inboxes
• Remove their access to the hosting account, if they had it
• Change any password they might have known
• Check the audit log for anything unusual in their last few weeks

It takes ten minutes and closes one of the most ordinary gaps there is.

Where Papaya fits

Papaya Admin is built with these basics in place: individual staff logins, login lockout, an audit log, nightly backups and security hardening, running on your own Cloudflare account so you own the data. The CRM page covers what is included, from $4,000 one-time plus Admin Care from $149/month. Published prices are on our pricing page, and the contact form books a scoping call or email.

Common questions

What are the basics of small business CRM security?

Individual logins for every staff member, a lockout after repeated failed logins, an audit log, tested nightly backups, HTTPS everywhere and removing access the day someone leaves.

Who is responsible for customer data in my CRM?

In Canada, the business that collects customer information is responsible for protecting it, even if a provider hosts the system. The Office of the Privacy Commissioner of Canada explains the obligations.

How often should CRM backups run?

Nightly is a sensible minimum for a small business admin system. Just as important, test a restore now and then so you know the backups actually work.