Why you should encrypt your company file

We make AcboBooks, one of the products discussed here.

What is in the file

A small business company file is one of the most sensitive things on the office computer. It typically holds:

• every customer and vendor, with addresses and contact details,
• your bank and card account numbers, and every payment,
• if you run payroll, every employee's pay, address and Social Security or Social Insurance number, and often their bank details for direct deposit,
• your full financial position, which competitors and fraudsters would both like to see.

With desktop software that file is on your disk, and a copy of it is on every backup drive and in every cloud folder you use. Each copy is a chance for it to end up in the wrong hands.

What encryption protects against

Encrypting the company file means its contents on disk are scrambled and can only be read with the key. Without the password, a copy is just noise. That protects you when the file leaves your control:

• A lost or stolen laptop. The thief gets the hardware, not the books.
• A lost backup drive or a USB stick left in a hotel.
• Backups in cloud storage. The storage provider, or anyone who breaks into that account, sees an unreadable file.
• A disposed or repaired PC whose disk was not wiped.
• A file sent by email to your accountant that ends up forwarded or stored somewhere you did not expect.

In AcboBooks the company file is encrypted inside the database itself, page by page, using the SQLCipher scheme with AES-256. The file on disk is encrypted at all times, including while the program is open, and it opens on any computer with the password. Older AcboBooks files created before encryption are offered protection the first time an administrator opens them.

Passwords and recovery keys

Encryption is only as strong as the password, and only as safe as your plan for forgetting it.

• Choose a long password. AcboBooks requires at least 8 characters; a phrase of four or five unrelated words is longer and easier to remember.
• Convenience on your own PC. AcboBooks can remember the password for your Windows user on that computer, sealed by Windows so another user or another machine cannot use it. The file then opens without asking on your PC, while a copy anywhere else asks for the password. If others share your Windows login, turn on Ask for the file password every time.
• Keep the recovery key. When a file is created, AcboBooks shows a 40-character recovery key once. Print it and store it away from the computer, with your other important papers. With it you can set a new password yourself.
• A last resort. With an active licence, you can ask for a password reset from My licences on acbobooks.com after proving who you are.

Two things to know: an Export Encrypted Backup uses a separate password that has no recovery, and user login passwords (who can sign in to the books) are different from the file password (who can read the file at all).

What encryption does not do

Be clear about the limits, so you cover them some other way:

• It does not stop someone at your unlocked computer. Once the file is open, or the password is remembered for a logged-in Windows user, it reads normally. Lock your screen and give each person their own Windows login.
• It does not stop ransomware or a failed disk. Ransomware can encrypt or delete an encrypted file just as easily. Only backups kept off the machine protect against that.
• It does not cover exports. PDF, Excel and CSV reports you save are ordinary files. Store them carefully and delete ones you no longer need.
• It does not cover the network. When AcboBooks hosts a file for other computers on the office network, that traffic is not encrypted. Use it only on a trusted network, and use a VPN for remote access.
• It does not fix weak passwords or phishing. A password written on the monitor protects nothing.

That is why disk encryption is still worth turning on as well: BitLocker on Windows Pro, or Device Encryption on Windows Home where the hardware supports it. It protects everything else on the laptop, including those exported reports.

A short checklist

1. Make sure your company file is encrypted; in AcboBooks, Company Settings shows it.
2. Use a long password and keep it somewhere other than the computer.
3. Print the recovery key and store it safely.
4. Turn on disk encryption for the laptop or PC.
5. Back up off the machine, and test a restore.
6. Give your accountant a user or an invite code rather than your own password (see what your accountant needs).

The security page describes everything else AcboBooks does to protect your books, and you can try it free on your own data.