Securing Your Company Files Without an IT Budget: Where a Small Business Should Start

If you run a small business or a micro-company, you already know the uncomfortable truth: you hold sensitive data (client contracts, invoices, payroll, ID documents, project files), but you do not have an IT department, a security budget, or anyone whose job is to worry about it. And yet a single ransomware infection, a lost laptop, or a mistakenly shared folder can cost you clients, trust, and in some cases a regulatory fine.

The good news: most of the risk comes from a handful of gaps, and closing them costs very little, sometimes nothing. This guide walks through where to actually start, in priority order, with honest trade-offs. It is written for the owner or office manager who wants real protection without hiring a consultant.

Quick Answer

A small business with no IT budget should secure its files in this order: first, turn on full-disk encryption on every device (BitLocker on Windows, FileVault on Mac, both free and built in). Second, set up automatic backups following the 3-2-1 rule, with at least one copy encrypted and off-site. Third, enforce strong passwords and multi-factor authentication on every account that touches company data. Fourth, control who can access what, and remove access the moment someone leaves. These four controls stop the large majority of real-world incidents (theft, ransomware, accidental leaks) and cost close to zero. Encrypting the files themselves, so that even your cloud provider cannot read them, is the next step up in protection.

Why this keeps small businesses awake at night

The fear is not abstract. Small businesses are targeted precisely because attackers assume they are soft. A few concrete scenarios:

• An employee laptop is stolen from a car. Without disk encryption, the thief plugs the drive into another machine and reads every file on it.
• A booby-trapped email attachment runs ransomware, encrypts the shared drive, and demands payment. Without clean backups, you either pay or lose everything.
• A folder of client documents is shared with "anyone with the link" and that link ends up forwarded, indexed, or leaked.
• A former contractor still has access to the Google Drive three months after the project ended.

None of these require a sophisticated attacker. They require a gap that nobody got around to closing. And if the leaked data includes personal information about clients or employees, you are not only facing an operational mess, you may have a regulatory obligation to report it.

This is the same problem freelancers face at an even smaller scale, and the logic is identical. If you work solo or with one or two people, the companion piece on how freelancers and consultants can protect client data without an IT department applies directly to you.

The four controls that matter most, in order

Security advice online is overwhelming because it lists a hundred things. For a business without dedicated IT, the right move is to do a few high-leverage things well rather than many things badly. Here is the honest priority list.

1. Full-disk encryption on every device (do this today)

This is the single highest-leverage control, and it is free. Full-disk encryption makes the entire contents of a laptop or desktop unreadable to anyone who does not have the login credentials. If a device is lost or stolen, the data on it is noise.

• Windows Pro: turn on BitLocker.
• Mac: turn on FileVault.
• Linux: use LUKS (often offered during installation).

Store the recovery keys somewhere safe and separate (a password manager, a sealed envelope in a safe). This takes minutes per device and protects against the most common physical-loss scenario.

One honest limit: full-disk encryption only protects a device that is powered off or locked. Once you log in, the files are decrypted and readable by anything running on the machine, including malware. It is necessary, but it is not the whole story. The difference between disk-level and file-level protection is worth understanding, and it is laid out in the guide on how to encrypt your notes and files in practice.

2. Automatic, tested backups (the 3-2-1 rule)

Backups are the control that turns a catastrophe into an inconvenience. The widely used standard is 3-2-1: keep 3 copies of your data, on 2 different types of media, with 1 copy off-site.

For a small business this can be as simple as: your working files on the laptop, an automatic sync to a cloud service, and a periodic copy to an external drive kept at home or in a safe. The two rules people forget:

• Automate it. A backup you have to remember is a backup that will not happen.
• Test the restore. A backup you have never restored from is a hope, not a backup.

For ransomware specifically, at least one backup copy should be offline or versioned, so that malware cannot encrypt your backups along with your live files. And if your backups contain sensitive data, the backup itself should be encrypted. The approach for doing that without leaking the data to the backup provider is covered in how to back up encrypted files without breaking zero-knowledge.

3. Strong passwords and multi-factor authentication

Stolen or reused passwords are behind a huge share of breaches. Two cheap fixes:

• Give everyone a password manager so each account gets a unique, strong password. Several are free for individuals or very cheap per seat.
• Turn on multi-factor authentication (MFA) everywhere it is offered, especially email, accounting software, banking, and cloud storage. Email is the master key to most accounts, so protect it first.

MFA alone stops the overwhelming majority of automated account-takeover attempts. It costs nothing but a few minutes of setup per account.

4. Access control and offboarding

The last cheap control is discipline, not technology. Decide who needs access to what, and do not share more broadly than necessary. Avoid "anyone with the link" sharing for anything sensitive. And keep a simple checklist for when someone leaves: revoke their accounts, remove them from shared folders, and change any shared credentials they knew.

Priority table

Control	Cost	Effort	Protects against
Full-disk encryption	Free (built in)	Minutes per device	Lost or stolen devices
3-2-1 backups	Low	Setup once, then automatic	Ransomware, hardware failure, deletion
Password manager + MFA	Free to low	Minutes per account	Phishing, reused passwords, account takeover
Access control + offboarding	Free	Ongoing discipline	Insider leaks, orphaned access
File-level (client-side) encryption	Free to low	Moderate	Cloud provider breach, subpoena, over-broad sharing

Where a standard cloud leaves a gap

Most small businesses store their files in a mainstream cloud: Google Drive, Microsoft 365, Dropbox. These are convenient and they do encrypt your data, both in transit and at rest on their servers. That is genuinely useful.

But there is a nuance that matters once your files contain client or employee personal data: in the standard cloud model, the provider holds the keys. Your files are encrypted on their disks, but the provider can decrypt them, because its own systems need to read them to index, preview, and serve them. That means your readable documents are exposed if the provider is breached, if an insider abuses access, or if the data is handed over under a legal order.

The practical difference shows up most clearly in a breach. With standard cloud encryption, a server breach can expose readable documents. With client-side (end-to-end) encryption, where files are encrypted on your device before they ever leave it, the same breach exposes only unreadable noise. This distinction is spelled out in what actually changes between local and classic cloud encryption when your data leaks, and the precise vocabulary (encrypted at rest versus end-to-end versus zero-knowledge) is untangled in the concrete differences between these three terms.

There is also a location question. If your provider stores or processes data outside the EU, that is a regulated situation under data-protection rules, not automatically forbidden but something you should be aware of. The honest version of that risk is covered in whether hosting data outside the EU is a GDPR problem.

To be fair to the mainstream clouds: for most small businesses, turning on their built-in protections plus MFA is already a big improvement over the status quo. Client-side encryption is the upgrade you reach for when the files are sensitive enough that "the provider can read them" is a risk you want to remove.

What this means concretely: a starter checklist

If you do nothing else, do this, roughly in order:

1. Turn on BitLocker or FileVault on every company device this week. Store the recovery keys safely.
2. Set up automatic backups to a second location, and make at least one copy off-site or offline. Then actually test restoring a file.
3. Roll out a password manager and turn on MFA on email, accounting, banking, and cloud storage.
4. Audit who has access to your shared folders. Remove anyone who no longer needs it. Stop using open "anyone with the link" sharing for sensitive files.
5. Write a one-page offboarding checklist and use it every time someone leaves.
6. For your most sensitive files (client records, HR, finance), consider moving them into storage that is encrypted on your device before upload, so a provider breach cannot expose readable documents.

Notice that steps 1 through 5 cost essentially nothing and can be done in an afternoon or two. That is the point: the expensive-sounding word "security" mostly comes down to a handful of free, built-in controls plus a little discipline.

Where Filarr can help (and where it cannot)

If step 6 is where you feel the biggest gap, that is the problem Filarr is built for. Filarr is a local-first workspace where your notes and files live encrypted on your own disk, with each file encrypted individually using AES-256-GCM. The encryption key is derived from your password and never leaves your machine in cleartext, so when cloud sync is turned on, the server stores only opaque encrypted blobs it cannot read. In practice that means a breach of the storage backend exposes unreadable noise rather than your client documents.

Concretely, for a small business, Filarr can be the place you keep your sensitive files and the notes that go with them, encrypted by default, free for local use, with optional cloud sync starting at 4 euros per month if you want copies across devices. You can also bring your own S3-compatible bucket if you want to control where the encrypted blobs sit.

Now the honest part, because overselling security helps no one:

• Filarr encrypts your files. It does not make you GDPR compliant on its own. Compliance depends on your whole data-processing practice (what you collect, why, how long you keep it, who you share it with), not on a single tool. This article is not legal advice.
• Filarr does not replace backups, MFA, or disk encryption. It is one layer. The four controls above still come first.
• Filarr is a young product (2026). Its mobile app is still in progress, and its ecosystem is smaller than long-established tools. If you need a mature, plugin-rich platform today, weigh that honestly.

Filarr is the right fit when you want files that are unreadable to the provider hosting them, in one place with your notes, without needing an IT team to set it up. It is not a silver bullet, and anyone who tells you one tool makes you "secure" or "compliant" is selling.

FAQ

We only have four people and no IT person. Do we really need any of this? Yes, and the size is exactly why. Attackers automate, so they do not care how small you are. The controls above (disk encryption, backups, MFA, access hygiene) are designed to be doable by a non-technical owner in a couple of afternoons, with no budget.

Is free, built-in encryption like BitLocker actually good enough? For protecting a lost or stolen device, yes, it is genuinely strong and you should turn it on everywhere. Its limit is that it only protects a powered-off or locked machine. Once you are logged in, files are readable, so it does not protect against malware or against a cloud provider reading synced copies. That is where file-level encryption adds a layer.

Our files are in Google Drive or Microsoft 365. Are they safe? They are encrypted in transit and on the provider's servers, which is good. The catch is that the provider holds the keys and can technically read your files, so a breach or legal order can expose readable documents. For most files that trade-off is fine. For your most sensitive records, client-side encryption removes that exposure.

What is the single most important thing to do first? Turn on full-disk encryption on every device, today. It is free, takes minutes, and closes the most common real-world incident (a lost or stolen laptop). Then set up automatic, tested backups.

How much should a small business budget for this? The four core controls can be done for close to zero: disk encryption and MFA are free, a password manager is free or a few euros per user, and backups can start with an external drive. Paid encrypted storage is optional and modest (Filarr's cloud sync, for example, starts at 4 euros per month). The scarce resource is attention, not money.