Protect client and payment information
The Federal Trade Commission's Start with Security guidance recommends considering security from the beginning, collecting only information the business needs, restricting access, protecting retained information, and overseeing service providers. For an agency, that principle applies to both payment operations and the client information already present in project, email, analytics, advertising, and collaboration systems.
Do not place cardholder data, bank credentials, passwords, complete account numbers, secret API keys, advertising-platform credentials, customer lists, or confidential campaign details in a general contact form, ordinary project notes, or an invoice description. Prefer provider-hosted collection paths where appropriate, give staff only the access needed for their role, remove access when responsibilities change, and review how exported reports are stored and shared. Security duties and available controls differ by business and provider, so the agency should confirm its own requirements with qualified professionals and the services it uses.