Keeping your business data safe
Practical steps for Mauritian businesses to protect invoices, client details and logins: roles, two-step login, activity logs and the Data Protection Act. A guide from Envoice.mu.
Most data problems in small businesses don't start with hackers. They start with a shared password written on a sticky note by the till, an employee who left in March and can still log in, or the owner's phone being the only place the recovery code lives. Those are the gaps worth closing first, and most of them cost nothing.
Know what you're protecting
Your invoicing system holds more than invoices. It holds client names, phone numbers and addresses, what each client bought and paid, your prices and margins, and in some businesses far more sensitive details.
Under the Data Protection Act 2017, you're responsible for the personal data you hold about clients and staff. Health data is a special category, so a clinic or practice needs patient consent before, say, sending a treatment plan to a patient's WhatsApp. If you're not sure what the Act asks of your business, ask your legal adviser or accountant.
One person, one login
Sharing one login across the office is a common mistake, and an easy one to fix. When five people use the owner's password, you can't tell who changed what, and removing one person means changing the password for everyone.
Envoice gives each person their own login and a role that fits their job: owner, admin, accountant, sales, technician or viewer. Your accountant gets the accountant role and your counter staff get sales, while the viewer role suits someone who needs to look but not change anything.
Plans include a set number of logins, and from Starter Plus you can add extra logins as a paid add-on. That's a small price compared with the mess of a shared password.
Turn on two-step login
A password on its own can be guessed, reused from a leaked site or read over someone's shoulder. Two-step login asks for a second code when someone signs in, so a stolen password alone isn't enough. Turn it on for the owner account first, then for anyone with admin or accountant access.
Know who did what
The activity log records who did what in your workspace, so when something changed and nobody remembers doing it, you can find out who and when. The Pro plan adds an audit log on top.
Locked invoices help here too. Once an invoice is issued it can't be edited, and corrections go through a credit note, so your history can't be quietly rewritten, by accident or otherwise.
When someone leaves
Remove their login the day they leave, not when you remember. Check the activity log for anything unusual in their last few weeks. If they knew any shared passwords for other systems (email, bank, suppliers' portals), change those too.
Don't be the only key-holder
If the owner is the only person who can get into the account, a lost phone or a hospital stay can lock the business out of its own records. Name a second trusted person (a partner, a family member in the business, your accountant) and make sure they have their own admin login and know where recovery details are kept.
What Envoice publishes about security
Envoice runs on Supabase, which encrypts stored data (AES-256) and every connection (TLS), and the database is backed up daily. Our public Security and your data page has the full picture.
Checklist
- ☐ Give every person their own login; stop sharing passwords
- ☐ Assign the narrowest role that lets each person do their job
- ☐ Turn on two-step login, starting with the owner
- ☐ Remove leavers' access on their last day
- ☐ Check the activity log once a month
- ☐ Name a second key-holder with their own admin login
- ☐ Get consent before sending health information by WhatsApp
- ☐ Ask your adviser what the Data Protection Act requires of you
Set up your team properly from day one
Start the free trial, with roles and two-step login included and no card needed: www.envoice.mu. Questions about security? WhatsApp +230 5881 9999.