Trust is the product: privacy and security for everyone

According to the ITU, 5.5 billion¹ people were online in 2024. Many of them now trust software with things that used to live in a locked drawer: customer lists, bank details, medical records, payroll, private messages. For a small business, the most valuable thing it owns may not be its stock or its premises. It may be what it knows about its customers.

That makes privacy and security central rather than technical. When a business chooses software, it is asking its own customers to trust that software too, usually without their knowing. Trust sits at the centre of what a software company sells, whether or not it says so.

Security should not be a premium tier

For years, many software companies have treated strong security as something to sell upwards. Detailed permissions, activity logs and stronger ways to sign in often appear on the most expensive plan, marketed to enterprises. Small businesses, who can least afford a breach, get the basics.

We think that has it backwards. A small firm that loses its customer list or has an account taken over may not survive the damage. It has no security team and no budget for incidents. If anything, the smallest customers need the strongest defaults, because they have the least capacity to configure anything themselves.

The smallest businesses need the strongest defaults, because they have the least time to change them.

What good defaults look like

Good defaults are boring, in the best sense. Passkeys, which resist phishing because there is no password to steal. Two-step sign-in for anyone who still uses a password. Roles, so each person sees what their work requires and nothing else. A log of who did what, so mistakes and misuse can be traced. Clear ways to remove access when someone leaves.

None of this is new technology. What matters is whether it is included and easy to switch on, or hidden behind an upgrade and a sales call.

It also matters who defaults are designed for. A security feature that assumes an administrator will read the documentation, configure policies and check a dashboard every morning will protect large firms and leave small ones exposed. Protection for everyone has to work for the owner who will switch it on once, on a phone, between customers, and never think about it again. That is a harder design problem than it looks, and a more important one.

Privacy is a matter of restraint

Security protects data from people who should not have it. Privacy asks a harder question: should this data be held at all? The most private information is the information never collected.

For a business, restraint is a practical discipline. Every field on a form is something that must be stored, protected and one day explained. Asking for less makes the job of protecting it smaller. It also tends to make customers more comfortable, because people notice when a form wants more than it needs.

Restraint applies to access as well as collection. A business does not need everyone to see everything. The part-time assistant who books appointments does not need the payroll. The agency that manages social media does not need the customer list. Giving each person only what their work requires is one of the simplest privacy measures there is, and one of the most often skipped because sharing a single login is easier.

For a software company, restraint is also a promise that has to be written down. How we handle data is set out in our trust centre, in language we try to keep plain. That is the right place to hold us to it, and we would rather be held to a clear promise than admired for a vague one.

We also think a company’s own conduct is part of its security. Clear explanations when something changes. Honest descriptions of what a feature does and does not protect against. No dark patterns that nudge people into sharing more than they meant to. These are not technical controls, but customers judge them, and they are right to.

Trust for everyone

Svayam Incarnation Limited builds Intersink so the same protections apply to everyone, from a person with a free User ID to an organisation running many businesses. Passkeys and two-step sign-in are available on every account. Every business and channel has roles, so owners decide who sees what. An audit log records who did what. None of these is sold as an add-on.

Pages you have already opened stay readable offline, and avatars are drawn on your device. These are small choices, but they mean less is fetched and sent than would otherwise be the case.

If a policy cannot be understood by the owner of a small shop, it is not doing its job. We try to write ours for that reader, and to keep them short enough that someone might actually finish them.

If a policy cannot be understood by the owner of a small shop, it is not doing its job.

Why it matters at scale

Small and medium firms make up 90%² of businesses worldwide. Each one holds the trust of its own customers: the patient who gave a phone number, the parent who shared a child’s details with a school, the regular who left a card on file. Software that protects that trust properly, for everyone and by default, protects a very large part of daily life.

Trust is slow to build and quick to lose. The companies that deserve it are the ones that treat it as the whole job rather than a line on a feature list. We would like to be one of them, and we know that is decided by what we do, not by what we write here.