⚠ A shared password or lingering delegated access lets a former provider, subcontractor or stolen laptop reach client inboxes and bank-linked invoice tools.
Mitigation
Use delegated roles or invites instead of shared passwords, a password manager, MFA, device encryption, and a one-click offboarding checklist that revokes access and logs each revocation.
⚠ Phishing emails impersonating a client or supplier trick the provider into sending invoices to altered bank details or paying fraudulent requests.
Mitigation
Require owner approval for any bank detail change via a separate known channel, lock invoice templates, and flag unusual payment requests to the owner.
⚠ Provider replies or posts under the owner's name with mistakes, leaking customer details or publishing unapproved content publicly.
Mitigation
Limit to approved templates, require owner approval for unusual replies and first-time posts, never post customer photos or names without consent, and keep an audit log.
⚠ Customer personal data, including health-related salon notes, is copied into personal drives, shared with other clients, or kept after the contract ends.
Mitigation
Use separate per-client folders, forbid personal storage, set retention limits, delete data on offboarding with a written confirmation, and sign a data processing agreement.
⚠ Upfront monthly payments are disputed or fraudulently charged, or a client's payment link is swapped so chased invoice money goes to the wrong account.
Mitigation
Take retainers via hosted checkout with clear terms, and send invoices only from the client's own payment account with provider access that cannot edit payout details.