Protecting customer data at a small service company

Why a small company is still a target

Home service companies hold exactly what criminals and scammers want: names, addresses, phone numbers, when homes are empty, alarm and door codes, photos of the inside of houses, and payment details. Most of these companies are small. In 2023, 58.3% of plumbing, heating and air-conditioning contractor establishments had fewer than five employees^[2]. Small teams rarely have an IT person, so the basics have to be simple enough for the owner to run.

Customers know the risk. Nine in ten US adults think people often or sometimes pretend to be someone else to steal personal information by phone or online^[3]. A company that can explain how it protects their data, in a sentence or two, earns trust that a competitor without a plan can't.

Take stock: what you hold and where

The FTC's guide begins with knowing what personal information you have in your files and on your computers^[1]. Spend one hour listing it.

Scale down: keep less

• Don't keep card numbers, expiration dates or security codes. The FTC advises against keeping customer card information unless there is a business need^[1]. Let your processor store cards for repeat billing.
• Delete access codes when a customer ends service or changes them.
• Set retention periods for call recordings and photos, and actually delete old ones.
• Don't collect dates of birth, Social Security numbers or other identity data you don't need for the job or for financing applications handled by the lender.
• Remove former customers' data from technicians' devices; it should live only in the job system.

Lock it: access by role

Most job management tools let you set permissions by role. Use them. A technician doesn't need the full customer list, and a part-time CSR doesn't need payroll.

• CSRs and dispatchers: customer contact details and job history; no exports, no payment data beyond the last four digits.
• Technicians: today's and upcoming assigned jobs, with access codes visible only on the day; no customer list or search.
• Office manager: billing and refunds, exports only with a reason.
• Owner: full access, protected with the strongest authentication.
• Everyone: their own login, never a shared one, with multi-factor authentication switched on.

Review permissions every quarter. Roles drift as people cover for each other, and temporary access given during a busy week tends to become permanent unless someone checks.

Technicians' phones

With 91% of US adults owning a smartphone^[4], almost every technician carries one, and it often holds customer data whether you planned it or not. Decide whether you issue company phones or allow personal ones, and set rules either way.

1. 01

   Lock the screen

   A passcode or biometric lock and auto-lock after a short idle period. No exceptions.

2. 02

   Keep data in the app

   Photos taken through the job app, not the camera roll. No screenshots of customer details or codes.

3. 03

   No codes in texts

   Access codes stay in the job record, not in group messages that live forever.

4. 04

   Plan for loss

   If a phone is lost, the technician tells the office within the hour, the office signs them out of company apps remotely and changes any codes the phone held.

5. 05

   Offboard the same day

   When someone leaves, remove their accounts and app access before the end of their last shift.

Payment data basics

If you accept cards, your processor will expect you to follow the card industry's data security standard, PCI DSS. For a small company, the simplest way to meet it is not to touch card numbers at all.

• Use payment links, card readers and your processor's stored-card feature instead of taking numbers by phone and typing them in.
• Never write card numbers on paper, work orders or sticky notes.
• Never ask for card details by email or text; tell customers you will never do so, which also helps them spot scams.
• Complete your processor's annual self-assessment questionnaire honestly; it is often short when you outsource card handling.

Phishing and payment fraud

Most small-company breaches start with a convincing email or text, not a hacker breaking code. Someone clicks a fake login page for the job software, or the office pays a supplier invoice to new bank details sent from a lookalike address. Train for the patterns you actually see.

• Treat any request to change bank details, by a supplier or a customer, as suspicious until confirmed by calling a number you already have.
• Log into tools from your own bookmark, never from a link in an email.
• Be wary of urgent messages that seem to come from the owner asking for gift cards or transfers.
• Report suspicious messages to one person, who warns everyone else the same day.
• Read fake invoice and payment fraud for the scams aimed at contractors.

Vendors handle your data too

Your job software, payment processor, answering service, call tracking tool and any AI phone agent all hold customer data. Ask each one: what data they store, where and for how long, who on their side can access it, whether they use it to train models or for marketing, how you export and delete it, and how they will tell you about a breach. Get the answers in writing. For AI phone tools specifically, see questions to ask an AI vendor about data privacy.

Tell customers what you do

Write a short, plain statement for your website and welcome emails: what you collect, why, who can see it, how long you keep it and how customers can ask you to update or delete it. Add a line that you will never ask for card details by email or text and never call asking for passwords. It reassures careful customers and gives them a simple way to spot someone impersonating you.

Pitch it and plan ahead

Pitch it: shred paper work orders that contain customer details, wipe old phones and laptops before selling or recycling them, and close accounts for tools you no longer use. Plan ahead: write a one-page incident plan.

1. Who to call first when something goes wrong: the owner and a named backup.
2. How to contain it: reset passwords, sign out devices, contact the affected vendor.
3. Who decides whether customers must be told, with help from an attorney familiar with your state's breach notification law.
4. Who talks to customers and what you will say.
5. Where you record what happened and what you changed afterwards.

Do state privacy laws apply?

Comprehensive state privacy laws usually apply only above thresholds. California's CCPA, for example, covers for-profit businesses with gross annual revenue over $25 million, or that buy, sell or share the personal information of 100,000 or more California residents or households, among other tests^[5]. Many small contractors fall below these lines, but security and breach rules can still apply. See do state privacy laws like the CCPA apply to you? for the details.

Example: a 30-day clean-up

Example: a fictional eight-person electrical contractor spent one afternoon on a data inventory and found alarm codes in a shared group chat, customer photos in personal camera rolls and two former employees still able to log into the job app. Over 30 days the owner removed the old accounts, switched on multi-factor authentication, moved codes into the job record, set the app to show codes only on the day of the visit, and wrote a one-page incident plan. The total cost was a few hours of the owner's time.