Property software may hold addresses, tenancy documents, repair reports and financial records. Protecting it requires more than remembering a password. The National Cyber Security Centre provides guidance for small organisations on securing accounts, protecting devices, backing up data and spotting attacks. The following editorial checklist applies those themes to a small property business.
1. Protect the main sign-in
Use a unique password or a supported passkey rather than reusing credentials from another service. Enable an additional verification step where the provider offers it. Pay particular attention to the email account used to recover the property-software account: access to that inbox may allow someone to reset other passwords. Follow the provider's current instructions rather than an old screenshot from a third-party tutorial.
2. Keep recovery under your control
Check the recovery address, telephone number and backup method. Store recovery information securely and decide who can use it if the usual administrator is unavailable. Do not leave the business dependent on a former employee's personal phone. Record the process without putting passwords in a shared maintenance spreadsheet.
3. Review who can do what
Use named accounts where possible and give people the access needed for their role. Review permissions when an agent, bookkeeper or contractor changes. Remove unused access through the normal provider controls. Shared administrator credentials make it harder to explain who changed a record or exported information.
4. Check backups and exports
Ask which data the provider protects and which records you must retain separately. Test whether an export includes the attachments and history you expect. Keep any exported personal information protected, and establish a recovery process rather than assuming that a download alone is sufficient.
5. Treat unexpected requests carefully
Verify unusual payment instructions or password-reset requests through a known contact route. Avoid relying on contact details supplied in the suspicious message itself. Keep devices and software updated and give staff a clear way to report a concern.
These measures reduce avoidable exposure but do not guarantee that an account cannot be compromised. Revisit the checklist when people, devices or suppliers change, and use the current NCSC and provider guidance for the action required. Reviewed 30 October 2026.
Source and further reading: https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security