Most small businesses run on personal devices to some extent. Someone checks email on their own phone, a director works from a home laptop, a part-timer uses their own machine two days a week. That is normal and it can be done safely. The risk is not the device, it is the work data sitting on it without anyone having thought about it.

Here is what makes the difference, in the order of how much it helps.

Try this first

1. Lock the device properly. A PIN of at least six digits, or a fingerprint or face unlock, with the screen locking automatically after a minute or two. A phone with work email and no lock screen is a mailbox anyone can pick up. This one step prevents more real-world incidents than anything technical.
2. Turn on multi-factor authentication for your work account. That is the code or approval you confirm on your phone. If your work account is set up by us, it is likely already on. If you are asked to approve a sign-in you did not start, decline it and tell us.
3. Use the proper apps, not the built-in mail app. On a phone, use Outlook and the Microsoft apps rather than the phone's default mail. It keeps work data inside the app, where it can be removed cleanly later, instead of scattered through the phone.
4. Keep the device updated. Turn on automatic updates for the operating system and the apps. Old phones that no longer receive security updates should not hold work email, and if yours is in that position we can tell you.
5. Do not save work files to your personal storage. Keep them in the business SharePoint, OneDrive or shared drive rather than your own iCloud, Google Drive or Downloads folder. When files live in the business systems, they are backed up, they are searchable, and they do not walk out the door by accident.
6. Set up your device to be found and wiped remotely. Find My iPhone on Apple, Find My Device on Android. Free, built in, and worth ten minutes on the day you do not need it.

A few things worth avoiding

• Family members using the same device for work accounts. Not out of suspicion, but because a shared device means shared browsing, shared downloads and shared risk. Separate profiles on a laptop solve this.
• Saving work passwords in a personal browser that syncs to a family account. Use a password manager, or ask us to recommend one.
• Forwarding work email to a personal address so it is easier to read. It quietly copies business data somewhere nobody manages, and it looks identical to what an attacker does, so it triggers alerts.
• Public wi-fi for anything sensitive without care. In practice, modern websites and apps are encrypted, so the real risk is lower than it used to be, but if you do a lot of work from cafes or airports, ask us about a VPN. A VPN is a private tunnel for your internet traffic.

What happens if the device is lost or you leave

Two questions people are often too awkward to ask, so here are the answers.

If you lose a phone or laptop with work email on it, tell us the same day, and ring 03 9028 4358 if it is urgent. We can sign the account out everywhere and, if the device is enrolled, remove the work data from it remotely. If it goes missing outside support hours, change your work account password straight away from another device and log a ticket, and we pick it up when support hours start the next business day. Acting quickly is what turns a lost phone into an inconvenience.

If you leave the business, the work account is disabled and the work data is removed. On a properly configured personal device, that means the work apps and their contents, not your photos, your messages or anything else of yours. We do not read personal content on a personal device, and we cannot see your private accounts. If you want that spelled out for your team in writing, ask and we will draft something short.

If you are the business owner

The one thing worth deciding deliberately is whether personal devices may hold work data at all, and if so, on what terms. A page is enough: the lock screen requirement, the multi-factor requirement, the rule that files stay in business systems, the obligation to report a lost device that day, and your right to remove work data when someone leaves. Agreed up front, it is uncontroversial. Raised for the first time on the day someone resigns, it is a fight.

We can help you set the technical side up so those rules are enforced rather than hoped for.

Still stuck?

Log a ticket at portal.yougrowit.com.au or email support@yougrowit.com.au. If it is stopping you working right now, call 03 9028 4358.

Support hours are Monday to Friday, 8:30am to 5:30pm Melbourne time, excluding Victorian public holidays.