Use privacy-safe information practices
Federal Trade Commission guidance recommends that businesses take stock of personal information, keep only what they need, protect retained information, dispose of it securely, and plan for security incidents. Restoration companies can apply those principles to mobile devices, job photos and notes, shared inboxes, customer records, exported reports, and any outside service used in the workflow.
Do not ask customers or field staff to place cardholder data, bank credentials, passwords, complete account numbers, or secret API keys in general forms, email, text messages, or project notes. Limit access according to staff duties, use the secure customer-facing or staff-facing interfaces provided for the chosen setup, and define a response for lost devices or suspected exposure. Confirm product-specific security requirements with the relevant provider before activation.