Protecting Customer Data at a Restoration Company

Pick up a tech's phone at the end of a busy month and scroll the camera roll. You'll find the inside of a few dozen strangers' homes: bedrooms, a kid's bathroom, the family photos along a hallway, a claim letter on a kitchen counter with the policy number in plain view, and at least one blurry picture of a thumb. Every one of those photos was taken for a good reason. Plenty of them also live in a personal cloud backup and a group text that still includes someone who left the company a while back.

A restoration company holds an unusual mix of sensitive information, and very little of it sits in a locked filing cabinet anymore. None of the fixes below need an IT department. Most of them take an afternoon and a little friendly nagging.

What you're actually holding

List what a typical job file contains, and it gets serious fast.

• Names, phone numbers, and addresses, sometimes for tenants and family members as well as the owner.
• Photos and video from inside the home, including rooms nobody would choose to show a stranger.
• Insurance details: the carrier, claim and policy numbers, and adjuster contacts.
• Signatures on work authorizations, contracts, and completion paperwork.
• Access details: lockbox codes, gate codes, alarm codes, and where the spare key is hidden.
• Contents inventories: a room-by-room list of what the family owns, what it's worth, and where it's stored.

Put the last two items next to a schedule showing the family is staying somewhere else while the house dries, and you have something a burglar would love to read. That's the real reason to care: a family trusted you with their house while they weren't in it.

One person, one login

Shared logins are a classic weak spot in a small office. The office email password lives on a sticky note, the job software has one login that four people use, and the password is the owner's first dog's name followed by 123.

Give every person their own login for every system that holds customer data. Then you can see who did what, and remove one person without changing everyone else's password. Use long, unique passwords, kept in a password manager so nobody has to remember them.

Next, turn on two-factor sign-in wherever it's offered, starting with email. Email comes first because it holds the keys to everything else: whoever controls an inbox can usually reset the password on every account tied to it. With a code from a phone app or a text message on top of the password, a stolen password alone usually isn't enough to get in.

The day someone leaves

Remove access the day someone leaves, every time, for everyone. It isn't a statement about the person. It's the same routine as collecting the truck keys.

Write it as a one-page checklist, the way you'd write any SOP your techs will actually follow:

• Accounts. Turn off email, job software, shared drives, company chat, and any e-signature or payment tools.
• Groups. Remove them from company social media accounts and from any group texts about jobs.
• Codes. Change the ones they knew: lockboxes, the warehouse door, the alarm, and any shared password that slipped through.
• Devices. Collect company phones, tablets, and laptops, and sign them out of business apps on any personal device they used for work.
• Email. Forward their inbox to a manager, so customer messages don't disappear into an account nobody reads.

Review access when people change roles, too. Give each person what the job requires, and check the list a couple of times a year.

The phone is the office now

Most of your customer data goes home every night in a pocket, a cup holder, or on a dashboard in the summer sun. Treat every phone that touches job data like a filing cabinet that happens to have wheels.

• Lock every screen. A real passcode or fingerprint or face recognition, set to lock quickly when the phone sits idle.
• Turn on find-and-erase. Both major phone platforms have a built-in way to locate, lock, or wipe a lost device remotely. It only helps if it's turned on before the phone goes missing, so check every work phone now.
• Keep software updated. Many updates fix security holes that are already publicly known, and those are the worst kind to leave open.
• Have a lost-phone plan. Who gets the call, which accounts get signed out, and when the device gets wiped. Write it down while nobody is panicking.

If your techs use their own phones for work, put the expectations in writing, and have your attorney review that policy before you hand it out.

Keep job photos out of personal text threads

Group texts are where good intentions go to multiply. A tech sends photos of an open wall to the project manager, who forwards them to a sub, who adds a buddy who might take the job. Those photos now sit in four personal camera rolls, back up to four personal cloud accounts, and stay there long after any of those people work with you.

Keep photos and job conversations in a business system tied to the job, where access ends when employment does. That's a security habit and a sanity habit at once, as our post on team communication explains. The same goes for claim letters, policy numbers, and signed documents: send them through a business channel, never a personal text.

While you're at it, watch for any email asking you to change where a payment goes. A message that seems to come from a vendor, a sub, or a customer and asks for new bank details deserves a phone call to a number you already had before anyone changes anything.

Questions to ask your software vendors

Every vendor that stores your job data is part of your security plan, whether it acts like it or not. Before you sign, and every so often after, ask:

• Does every user get their own login, and can we require two-factor sign-in?
• Can we set roles so people only see what their job requires?
• When we remove someone, does their access end right away, on phones too?
• Is our data encrypted in transit and at rest?
• How are backups handled, and how would we get our data back after a problem?
• Can we export our data if we leave?
• If there's a breach, how and when would you tell us?
• Is there a log of who viewed or changed what?

Ask for the answers in writing. A vendor that takes this seriously will usually have them ready. For reference, riivet describes its own practices on our security page.

Before a job photo goes public

Before-and-after photos make good marketing. They're also the easiest way to hand a customer's address to the entire internet. Before any job photo goes on your website or social accounts:

• Get the customer's permission in writing.
• Crop out house numbers, street signs, license plates, and recognizable exteriors.
• Leave out faces, family photos on the walls, mail, documents, prescription bottles, and anything on a screen.
• Strip the location data. Phone photos can carry the coordinates of where they were taken inside the file itself. Some sites remove it on upload and some don't, so don't count on it.

The rules, and who to ask

Privacy and data breach rules vary by state. Talk to your attorney about what applies to you and what you'd need to do if something went wrong. If you take card payments, ask your payment processor what it expects of you.

A starter list for Monday

You don't need a security department. You need habits that hold up during a busy week:

• Individual logins and two-factor sign-in, starting with email.
• A same-day offboarding checklist that includes the lockbox codes.
• Locked, findable, updated phones, and a lost-phone plan.
• Job photos and documents in a business system, not personal texts.
• Written answers from every vendor that holds your data.
• Permission and a careful crop before any photo goes public.

Families trust you with their house on one of the worst weeks they'll have. Guarding their information as carefully as their lockbox code is part of the job.