Keep administrative and payment data appropriately separated
Child care records may contain family contact details and other sensitive administrative information that is not needed to process a payment. Design the workflow so the processor receives only the information necessary for collection and reconciliation. Do not put full card numbers, security codes, bank credentials, passwords, medical details, or secret access keys into general forms, email, chat, spreadsheets, or free-text notes.
The Federal Trade Commission's current small-business cybersecurity guidance recommends practical controls such as limiting access to sensitive assets, using multi-factor authentication, updating software, backing up important files, encrypting sensitive data, training staff, and preparing an incident response plan. Apply those principles to office computers, shared inboxes, administrative portals, and any device used to collect or review payments.
Review the fraud prevention and security resource for additional operational questions. Security and legal obligations depend on the center, the information it handles, and the services it uses, so obtain qualified guidance where required rather than relying on a general web page as legal or compliance advice.