# Cybermois: protecting your rental business, accounts and property access Source: https://stayclean.io/press/cybermois-protect-rental-business-accounts-property-access Language: en Author: William Rudent Published: 2026-10-14T00:00:00+00:00 Passwords, team permissions, suspicious messages and entry codes: practical habits to protect the day-to-day running of a holiday rental business. A holiday rental management business uses messaging services, booking platforms, coordination tools and property access information every day. These are shared among several people, sometimes in the rush before an arrival. [Cybermois 2026, France's cybersecurity awareness campaign](), offers a practical opportunity to review these habits. Start with a few rules that the whole team can apply, then check that they actually work day to day. ### Take stock of essential accounts List the services your business depends on: your main email account, bookings, property management, document storage and on-site coordination. For each one, identify the person responsible, authorised users, recovery methods and the consequences if it becomes unavailable. Pay particular attention to email, which is often used to reset passwords for other services. Use a long, different password for every account, stored in a suitable password manager rather than an unprotected shared document. Enable multifactor authentication wherever it is available. [France's ANSSI recommends prioritising this mechanism and using a password vault](). Also prepare for account recovery: who steps in if the phone used for authentication is lost? Backup recovery methods must remain protected and accessible only to authorised people. ### Give each person the access their work requires Someone handling a changeover may need an address, a time slot and specific instructions. That does not necessarily mean they need to view guests' entire history or administer bookings. The French data protection authority [CNIL recommends limiting permissions to actual needs and removing those that are no longer necessary](). Prioritise individual accounts and the roles available in your tools. When granting temporary access for someone providing cover, set its removal date from the outset. Include access checks in your procedures for onboarding, changes of assignment and departures. Name the person who makes the change, then confirm that it has taken effect. This matters just as much for an occasional contractor as for a permanent team member. ### Slow down when a request is unusual A supposed emergency can look very convincing: a booking threatened with cancellation, access that needs reactivating, a document to view or bank details to update. A familiar name and polished presentation are not enough to authenticate a message. Before signing in, open the service through your app or a trusted bookmark. For an unusual request, check with your contact through an established channel. Do not give a password or authentication code to someone who asks for it in a message. These habits follow [Cybermalveillance.gouv.fr's advice on avoiding phishing](). A simple team exercise is enough to start the discussion: faced with a fake account-suspension message, what would each person check? ### Handle keys and entry codes separately Securing a digital account does not, by itself, control the circulation of physical keys. Keep an inventory of key sets, the people holding them and any returns due. Avoid putting a full address on a key that could be lost. For key safes and code-operated locks, define a procedure specific to each device. Where the equipment supports it, use temporary access that matches the stay or visit. Limit the distribution of codes and avoid leaving them in lengthy group conversations. Document what to do if a key is lost or a code is disclosed. Coordinate any changes with the people concerned to preserve access for occupants and authorised workers. A smart lock's administrator account must also be protected as a sensitive account. ### Prepare a response before an incident Keep a sheet with contact details for the services you use and the person responsible for security. If you suspect an account has been compromised, follow [Cybermalveillance.gouv.fr's official incident guide](): preserve evidence, regain control of the account, change the compromised password and sign out unknown sessions. Also check email forwarding rules and recovery settings. Then assess the practical consequences: was property access information exposed? Did guests receive a fraudulent message? Were bookings changed? Get support to determine the appropriate measures and any steps required in relation to personal data. A short, regular review helps keep these rules up to date. To better organise the information you share with your usual teams, discover [StayClean](), a platform for coordinating cleaning and on-site operations. Whatever solution you use, security also depends on the access you grant and each user's habits. ### Sources - [Cybermalveillance.gouv.fr: Cybermois 2026]() - [ANSSI: multifactor authentication and passwords]() - [CNIL: managing access permissions]() - [Cybermalveillance.gouv.fr: responding to an account compromise]() ![AI-generated illustration: a manager checks her phone in front of her computer in a holiday rental management office with a locked key cabinet.]()