I Spent a Day Locking Down My Own CRM. Here's What Went Wrong (and What Went Right)

I help people feel confident about technology and staying safe online. So it would be a bit embarrassing if my own systems were held together with good intentions.

Over the last few weeks I've been building my own CRM, the system that keeps track of enquiries from my websites. It works. People can fill in a form, and it lands in one place where I can see it. But "it works" isn't the same as "it's safe", and this week I decided to fix the gap.

Here's what I did, what went wrong, and what I'd tell anyone running their own small business systems.

A backup you've never tested isn't a backup

I'll be honest: until this week, if my server had died, I'd have been in trouble. No automatic backups.

So I set them up. Every night the system now takes a copy of everything, scrambles it so only I can read it, and sends it to a completely separate place. If my server disappears tomorrow, the copy is somewhere else.

My first attempt at sending it away failed. The storage service kept refusing my login, and it took a few tries to work out that the access I'd given it was set up a bit too tightly. A frustrating hour, but it ended well.

The important part came at the end. I took last night's backup, turned it back into a working copy, and checked it against the real thing. The numbers matched. Users, contacts, enquiries, activity records, all there.

That last step is the one most people skip. A backup that has never been restored is a hope, not a plan. Test yours. Today, if you can.

Adding people without handing out passwords

Until now it was just me. But businesses grow, and one day someone else will need to log in.

The lazy way is to give them my password, or set one up for them and send it over. Both are bad ideas. Passwords shared over email or chat tend to live forever.

So now I invite people instead. I enter their email and what they're allowed to do, and the system makes a one-time link that expires after 48 hours. They open it and choose their own password. I never see it, and neither does anyone else. Once the link has been used, it's dead.

I also gave different jobs different levels of access. Someone helping with the website doesn't need to see my customers' details. Someone who only needs to read enquiries shouldn't be able to change anything. And there's a rule I'm quite pleased with: the system won't let you remove the last administrator, so I can't lock myself out by accident.

The principle is simple: give people the access they need and nothing more.

The login that asks for more than a password

Passwords get stolen, guessed and reused. That's why I turned on two-step login.

After my password, the CRM now asks for a six-digit code from an app on my phone. I used Microsoft Authenticator, but Google Authenticator and most password managers work just as well. You scan a picture once, and from then on the app gives you a new code every 30 seconds.

When you switch it on, you also get a set of one-time recovery codes. Those are your way back in if you lose your phone. Save them somewhere safe, like a password manager. Don't take a screenshot and leave it on your desktop.

If you're not using two-step login on your email, your bank and your business tools, that's the single best thing you can do this weekend.