When people hear "security" they picture hackers and firewalls. In practice, most security problems in business software come from a handful of ordinary things done badly. The good news is that the basics are well understood, and any team building a system for you should be able to talk about them plainly.
Access: who can see and do what?
The most valuable security feature is often the least exciting one: making sure people only see what their job requires. That means roles, not a single shared login. A salesperson does not need payroll data. A contractor does not need your customer list.
Ask: can access be given and removed per person, and per role?
Sign-in that is hard to abuse
Weak or reused passwords are behind a large share of breaches. Sensible systems support strong sign-in, such as two-step verification, and make it easy to remove access when someone leaves.
Validate everything that comes in
Anything a user types, uploads or sends can be wrong, and sometimes malicious. Careful systems check inputs on the way in, rather than trusting them. This is one of the most common sources of vulnerabilities, and one of the most preventable.
Know what happened
Audit trails record who changed what and when. They help you answer questions after a mistake, and they discourage mistakes in the first place.
Backups, and testing them
A backup you have never tested is a hope, not a plan. Ask how often data is backed up, where copies are stored, and how long it would take to recover.
Keep things up to date
Software depends on other software, and those pieces need regular updates. Ask who is responsible for applying them after launch.
Handle personal data carefully
If your system holds personal information, think about what you actually need to collect, who can see it, and how long you keep it. Collecting less is itself a security measure.
Common mistakes
Shared logins ("everyone uses the office account") make it impossible to know who did what or to remove one person's access. Passwords reused across systems turn one breach into many. Updates postponed "until things are quieter" leave known holes open. And backups that have never been restored give a false sense of safety. Each is cheap to fix and expensive to ignore. We cover the last one in backups and recovery, and the data side in our GDPR checklist.
A short checklist to start with
Does every person have their own login? Is two-step verification switched on for anything important? Can you remove a leaver's access in minutes? Are updates applied on a schedule? Are backups tested? Do you know where your data is stored? Six yes answers put you ahead of many businesses.
A final question
If you are choosing a team to build something for you, ask them to explain how they think about these things. You are not looking for jargon. You are looking for clear answers, and for people who treat security as part of the design from the start, not a box to tick at the end.