Is Cloud Billing Software Safe? A Security Checklist

The usual objection we hear from shop owners is blunt: 'If it's on the internet, anyone can see it.' It is a fair worry. Your invoices show who you sell to, at what rate, and how much they owe. That is information a competitor would love to have.

The truth is less dramatic and more annoying. Most breaches of small-business data do not come from clever hackers attacking the vendor. They come from a shared password on a sticky note, an ex-employee who still has a login, or a laptop left open at the counter. Cloud safety is split between the provider and you.

What to ask the vendor

You are not auditing a bank. You are looking for signs that the people running the service have thought about this. We would ask these and expect clear, non-defensive answers.

• Is all traffic between my browser and your servers encrypted? (Look for https in the address bar; ask about stored data too.)
• Where are the servers hosted, and by which provider?
• How often is data backed up, and have you actually tested restoring a backup?
• How is my business's data separated from other customers' data?
• What happens to my data if I cancel? Can I get it out, and is it deleted afterwards?
• Who on your team can see my data, and under what circumstances?
• What is your process if something goes wrong, and how will I be told?

Treat vague answers as an answer. 'Don't worry, it's totally secure' with nothing behind it should lower your trust, not raise it. We cannot vouch for any vendor's claims for you, including ours, so ask for specifics in writing.

What you control: the human side

A strong lock does nothing if the key is under the doormat. In small businesses, the doormat is nearly always one of these.

Passwords and logins

Use a unique password for your billing account, long enough that it is not a name plus a birth year. If the software offers two-step verification, turn it on for the owner login at least. Do not share one login among the whole counter team. Shared logins mean no one can tell who changed a bill, and when someone leaves you have to change the password for everybody.

Staff access

Give each person their own login and only what they need to do the job. A billing clerk rarely needs to see profit figures. We go deeper on this in our guide to roles and permissions for billing staff. When someone leaves, remove their access the same day, not at month end.

Devices and networks

Log out on shared computers. Avoid opening your books on public Wi-Fi at a railway station without good reason. Keep the phone or PC you use for billing updated, and do not install random cracked software on the counter machine.

Do not skip your own backup

Even a careful provider can have bad days. Keep your own periodic copy of the things you cannot recreate: customer list, product list, month-end reports, and PDF copies of invoices. How you can do this depends on what the software lets you export, which is exactly why it is on our list of questions for backups and exports.

Cloud is not always safer, and not always worse

A PC at your counter with no backup, an old operating system and a shared password is not secure just because the data is 'in your own shop'. A well-run cloud service with separate logins and tested backups can be a safer home for your books than a drawer full of pen drives.

It is also fine to decide cloud is not right for you. If your internet is unreliable or your comfort level is low, a locally installed tool with a disciplined backup routine is a reasonable choice. The goal is honest risk, not a particular technology.

Where we stand

We run Billy with separate businesses under one login and light and dark modes, but security is about specifics, so ask us the questions above before you sign up. If you have unusual compliance needs, such as hosting in a particular place or additional approvals, contact us and we will tell you plainly what we can and cannot do. For a wider checklist, our buyer's guide puts security next to price, support and fit.