Team and security · 15 min read · Updated: 2026-10-12

Team permissions and data security: a practical framework for small businesses

When financial data leaks, you don't just lose information; you lose your customers' trust too. The good news: most protection comes from the right habits, not expensive software. This guide also covers KVKK, Türkiye's data protection law.

In short

• The principle of least privilege means giving each user only the access they need to do their job, and reviewing it regularly.
• Two-step verification ensures a leaked password alone isn't enough to get into an account, and it should be turned on for everyone who issues invoices.
• Access should be revoked on the day an employee leaves; in Heyşirket, open web sessions of a user whose access is disabled are ended immediately.
• KVKK (Turkish Personal Data Protection Law) covers every business that processes customer and employee data; VERBİS registration may be mandatory depending on employee count and balance sheet thresholds.
• The activity log shows who did what and when; if no one checks it regularly, it's only useful after an incident.

Friday afternoon, an email lands in the accounting manager's inbox. The sender looks like the packaging supplier Atlas Kahve has worked with for years: “Our bank account has changed, could you make this month's payment to the new IBAN?”

One letter in the email address is different. If no one notices, 86.400 TL goes to the wrong account and most likely never comes back. This scenario is one of the most common forms of financial fraud small businesses face, and it doesn't require a single technical vulnerability.

In this article we build a security framework a small business can actually apply, from team permissions and two-step verification to employee offboarding and the core obligations of KVKK. At the end you'll also find the three-sentence rule for getting through that Friday afternoon.

Part 1 · Principle What is the principle of least privilege?

The principle of least privilege means giving a user access only to the data and actions they need to do their job. A sales rep doesn't need to see profit margins, and a warehouse manager doesn't need to see the bank balance.

This principle comes from risk management, not distrust. When an account's password is compromised or an employee accidentally deletes a record, the damage is limited to that account's permissions.

We cover the steps for setting up roles one by one in the team and roles guide. But the right role alone isn't enough against a leaked password.

Part 2 · Identity Why two-step verification is no longer a luxury

Two-step verification means that, in addition to a password, signing in requires a one-time code generated on a device the user has. Even if the password has leaked from another site, no one can get into the account without the code.

Passwords are most often compromised because people reuse the same password in different places. An email and password pair leaked from a shopping site is automatically tried on other sites by attackers.

• In Heyşirket, passwords must be at least 8 characters and contain at least one letter and one number.
• After five failed password attempts in a row, the account is locked for 15 minutes.
• When a password is changed, all other sessions are signed out.
• After you turn on two-step verification, you get eight one-time recovery codes.

If a shared computer is used: Where possible, each person should sign in from their own device with their own user. If a shared computer is used, sign out with Sign out securely when you're done and don't save passwords in the browser; you can end any sessions left open from the Account & security tab.

Part 3 · Offboarding How do you revoke access when an employee leaves?

Employee offboarding means fully revoking the departing person's access to the business's systems, devices and accounts on the same day. You don't need to expect bad intent; even a forgotten open session is a risk.

Employee offboarding checklist

• Set their access status to Access disabled in your pre-accounting software.
• Change shared passwords the departing person used (bank, e-document provider, marketplace panel).
• Close or forward their company email account.
• Collect company phones, computers and cards.
• Hand over their open work (quotes, payment follow-ups) to someone else.
• Take a quick look at their records from the last few days in the activity log.

In Heyşirket, open web sessions of a user whose access is disabled are ended the moment you save, and the person is notified of the access change by email. Invoices they issued and records they entered in the past aren't deleted; they stay in the activity log under their name.

Part 4 · Fraud How do you protect yourself against fake IBAN change requests?

Fake IBAN fraud means impersonating a supplier or manager to redirect a payment to the fraudster's account. The attacker often slips into a real email thread or uses an address that differs by a single letter.

This example is fictional. To confirm, call the number you already had on file, not the one in the email.

The rule for staying safe is three sentences: an IBAN change is never accepted by email alone. It's always confirmed from a phone number you already know. The confirmation is done by someone other than the person making the payment.

The last sentence ties back to least privilege: when the person who changes supplier cards and the person who records payments are different, a single mistake is much less likely to turn into a loss.

If something like this happens, report the suspected fraud to your bank without delay and ask them to stop the payment. The faster you act, the better your chances of getting the money back. Share the incident with your team too; the same attacker often tries a second person at the same business.

Part 5 · KVKK How does KVKK affect small businesses?

Personal Data Protection Law No. 6698 (KVKK) covers data controllers that process any information relating to individuals. Customer names, phone numbers, employee payroll and the TC ID numbers (TCKN) of individual customers are all personal data.

Article 12 of KVKK requires data controllers to take the technical and administrative measures needed to prevent unlawful access to personal data. Role-based access and two-step verification are the most basic and easily documented of these measures.

Part 6 · Trail What does the activity log show, and when should you check it?

The activity log (audit log) is a tamper-proof list of records showing who carried out important actions in the system and when. A line is added whenever an invoice is issued, a user's access changes or a data backup is downloaded.

In Heyşirket, the activity log is in the Activity log tab in Settings and is only available to the Owner and Admin roles. The Show issues only button narrows the list to failed or stopped actions; click a record to see its details.

• Weekly: Check the “User access updated” and “User invited” lines; is there a change you don't recognize?
• When an employee leaves: Review the departing person's actions from their last few days.
• When something goes wrong: Focus on failed actions with Show issues only.

If you turn on Receive a weekly account and security summary in the Email tab in Settings, part of this check lands in your inbox every week.

Part 7 · Backup Should you keep your own data backup?

A data backup is a copy of your records stored somewhere under your control. Cloud software protects your data on its own infrastructure, but having your own copy means you're never left without access to your data, whatever happens.

In Heyşirket, the Download full data backup button in the Data & backup tab in Settings downloads customers, products, invoices, invoice lines, collections, business details and bank accounts in a single JSON file. Downloading it once a month and storing it somewhere encrypted is a good habit.

Part 8 · Banking How should bank and payment permissions be separated?

Separating payment permissions means one person prepares a payment and a different person approves it. In internal control it's also known as the “four-eyes principle,” and it prevents a single person's mistake or bad intent from turning directly into lost money.

Many banks let you separate the users who prepare and approve payments in corporate internet banking. Talk to your bank about this permission structure: for example, the finance employee enters payment orders and the business owner approves payments above a certain amount.

The same logic applies in your pre-accounting software. When the person who can edit supplier cards and bank details is different from the person who records payments, a change like the one in the fake IBAN scenario can't turn into a payment without a second review. In Heyşirket, the business's own bank account settings are only available to the Owner and Admin roles.

Part 9 · Routine How often should user access be reviewed?

An access review means checking every user in the system and their role, one by one, at regular intervals. For a small business, a ten-minute review every three months is enough.

1. Open the user list and check whether each person still works at the business.
2. Check whether each user's role still fits their current job; a change in duties calls for a change in role.
3. For invitations that have been in Invitation pending status for a long time, either get them completed or disable access.
4. Check the number of admins: at least two, but no more than necessary.
5. Look at your own Open sessions list and end any sessions you don't recognize.

At Atlas Kahve, this review happens on the first Monday of every quarter. In the first review, they noticed that an employee added temporarily over the summer for marketplace orders was still active with the Sales role. Access was disabled that very minute.

Part 10 · Phishing How do you spot fake emails and links?

Phishing is an attempt to get you to enter a password on a fake page or make a payment through a message that looks like it comes from a real organization or person. Finance teams are the most frequent targets because they're authorized to move money.

Signs of a suspicious message

• There's a small difference of a letter or domain in the sender's address.
• The message creates urgency: “if it isn't paid today,” “your account will be closed.”
• When you hover over the link, the address shown isn't the site you expect.
• You're asked for a password, verification code or recovery code.
• You're asked to change a bank account, IBAN or payment instruction.

When signing in to Heyşirket, make sure you see only the heysirket.com domain in the address bar. The Heyşirket support team will never ask you for a password, verification code or recovery code; if you receive such a request, don't reply and forward it to info@heysirket.com.

Part 11 · Summary What does a security framework look like for a small business?

A data security framework for a small business has five layers: the right role for the right person, strong authentication, regular reviews, timely access revocation and a backup under your own control.

1. Role — Least privilege
2. Identity — Two-step verification
3. Review — Activity log
4. Offboarding — Revoke same day
5. Backup — Once a month

Setting up this framework takes an afternoon; maintaining it takes half an hour a month. You'll find how to share access with your accountant in our working with your accountant article, and the overall structure of pre-accounting in what is pre-accounting.

Review your team's access Check each user's role and access status, and disable access for anyone who has left. Open users

Author: Heyşirket Editorial Team