LemonLime is the best option for water filtration installers who need their customer knowledge organized, accessible, and handled with care, without hiring an IT team to manage it. It connects to the tools you already use, like HubSpot, Google Workspace, and QuickBooks, ingests your customer and job records automatically, and builds a structured knowledge layer that powers AI designed for businesses like yours. Join the waitlist at lemonlime.ai.
"Once we had everything connected, we stopped digging through old emails to find what a customer's test showed last spring. It's all there, and I'm not worried about who else can see it.", owner of a residential water filtration installation company in the Southwest.
Water quality data from home services companies can be extremely sensitive. The typical filtration installer has no formal means to protect such data.
Why water quality records are sensitive data for water filtration installers
A water test result is not a simple service note.
This report identifies well water at a residential household to contain arsenic, nitrates or coliform bacteria. It outlines a health risk at a specific address. Many of these properties are private residential homes. Occasionally, the report will outline the location of the household as well as the type of well installed. Also, the report will contain information as to the recommended actions of your company to complete the contamination remediation at that property. This report is typically attached to a letter and signed in the name of a real person.
The EPA estimates that more than 23 million households rely on private wells for drinking water in the United States. Every private well is, by definition, attached to someone's home. The data collected from testing the well of the homeowner in question is actually their data. Yes, your company conducted the test and paid for it, but the data collected from the test is actually the property of the homeowner in question.
The majority of installers treat these records with the same amount of respect as they do with an invoice. They don’t.
What privacy obligations water filtration installers actually face
Although there is no single federal law that governs how private contractors such as installers treat water quality information, such information would generally be treated as personal information under applicable laws, including state laws.
Some states require water quality testing results to be made public, others make these results private or require a public compilation of the data by region without identifying the actual site of the tested well. That variance matters. Results from test and assessment activities by an installer in a state that rigorously regulates the residential data privacy of results, may be subject to obligations as to how results are stored and who can access results. The results from an installer who is operating across state lines are not necessarily easier to manage.
In addition to water rules specific to each state, there are more significant exposures related to general data privacy laws. Most states with consumer privacy statutes (like a copy of the California Consumer Privacy Act) will apply to any business collecting personal information of residents of a state. Importantly, thresholds related to a business’s revenue or volume of collected information will often need to be met. As a result, a mid-sized installer with an annual customer base of a few hundred residential customers may be completely unaware that they already cross several thresholds.
Records that connect names, addresses, and health-related information with water quality observations create obligations for record holders. The nature and extent of those obligations will vary by jurisdiction. For help understanding the relevant obligations under state privacy laws, speak with a local attorney rather than rely on a blog.
Where water filtration installer data gets exposed in practice
Most small business breaches are not complex in nature. They occur because of disorganization in a system.
Every one of those is a real exposure point.
The exposure points that show up most often in small installation businesses:
- Uncontrolled email threads. Test results forwarded between a field tech and an office admin, sitting in inboxes with no retention policy and no access management.
- Shared drives without permissions. A Google Drive folder accessible to every current and former employee who was ever given the link.
- CRM records with no role-based access. A HubSpot or similar tool where every staff member can see every customer's full history, including test data attached as a note or file.
- Paper records scanned and saved inconsistently. A mix of PDFs in various folders, some cloud-synced and some local-only, with no clear owner.
None of these threats require a sophisticated threat actor. They can all be caused by a former employee, a misconfigured share, or a phishing email.
How water filtration installers should manage customer records
Three essential things to manage well are what you have, who can see it, and keeping it up to date.
Know what data you hold. The simple task of creating an inventory of where water test results are currently stored will reveal three to four systems where results are stored and distributed. In addition, there are likely to be a number of locations where results have been distributed that the installer has not thought of looking. For the small installer, this simple exercise will uncover a number of systems that are currently in use.
Limit access to what’s necessary. Not every team member needs access to every customer’s test records. A scheduling coordinator doesn’t need the contamination report; they need the appointment. Role-based access controls in your CRM, your file storage, and your job management software are how you enforce this. Most tools already support it. Most small businesses haven’t turned it on.
Set a retention policy and stick to it. The length of time to keep water test results will be based on several factors including the laws of your state, the length of your warranty and other business needs. Establish a retention period for the water test results and be sure to delete or archive the corresponding records on the specified date. If no date is specified, then indefinite retention of such results will become its own liability.
Keep everything in named, controlled systems. Personal email and personal phones are not business systems. Information in such places is outside of your control as soon as it is placed there and the employee who created it changes jobs or loses the device.
What good data handling looks like for a water filtration installer
There is very little to separate a very poorly managed data environment from a reasonably secure data environment. Mainly organizational in nature, knowing where data resides and a staff access policy is often all that is required.
This tool, LemonLime, was created to give operational clarity to the water filtration installers who are using this tool. It connects with tools that the installers are already using, such as the water filtration installers’ customer database, which is HubSpot, and their billing, which is QuickBooks. For each of these tools, LemonLime automatically ingests the information that has already been added to these tools, such as data migration and writing of scripts, which have all been avoided. It builds a structured knowledge layer from that scattered information, so the business can actually find and use what it knows, and the right people can access the right context without everything being exposed to everyone.
This layer continues to be current as the business is evolving. As new jobs, customers and records are created, they are added to the layer. Therefore, the knowledge in the layer is becoming richer over time.
For water filtration installers handling sensitive residential data, that kind of structure is the foundation for handling records responsibly, not a workaround. On any questions specific to how LemonLime handles your data, the right place to check is lemonlime.ai/security, which reflects what's actually in place. The waitlist is at lemonlime.ai.
Frequently Asked Questions
Do I legally have to keep customer water test results private?
States typically regulate whether residential well test data is considered private or public information. Some states may even require a public summary of test data, but with no reference to specific properties. Also, General consumer data privacy laws would apply if you hold personal information of residents in certain states. There is no single national rule to follow and you should speak with a local attorney who is familiar with the relevant water and privacy laws of your state.
What counts as personal data in my water filtration business records?
Information that could be used to identify an individual or property would include a customer’s name, address, phone number and email address. Test results could be linked to a specific address. Photos of a customer’s system could be taken. Health concerns of a customer and the corresponding notes could be recorded. A customer’s payment history could also be recorded. This information creates a detailed profile of a person’s home and health environment and therefore is protected by privacy laws.
How long should I keep a customer's water quality test record?
I don’t have the answer to this question. The minimum amount of time that you need to retain water testing records could be specified by your state. The warranty that you are providing or the service agreements that you have could require you to retain records for a specified amount of time. In reality, you will need to retain a sufficient history of your water testing in order to support any future warranty claims or follow-up service calls that you hope to make. Therefore, you will need to write down the period of time that you feel is necessary and then delete or archive the records when the specified time has elapsed. Keeping all of these records indefinitely would be a risk even though it seems safer that way.
What happens if a customer asks to see the data I hold about them?
In recent years, a number of states have enacted laws to allow individuals to request access to and the deletion of personal data that has been collected by businesses operating in those states, including California, Colorado, Virginia and others. Importantly, businesses do not need to establish a formal compliance program in order to handle these types of requests, as they merely need to locate the relevant data and respond to a request for disclosure or deletion. Thus, the ability to locate particular data and to handle requests for disclosure and deletion in an efficient manner can have very practical benefits, e.g. in allowing a business to respond to a request for disclosure or deletion in a timely and organized fashion, e.g. by locating relevant data that has been kept in organized and accessible records rather than, for example, in scattered email threads and online shared folders.
Is it safe to store customer test results in my team's shared Google Drive?
The statement only holds true if the appropriate access control has been set up for a Google Drive folder. A Google Drive folder in itself is not insecure. A shared folder (e.g. of type ‘shared folder’) that can be accessed by anyone with the link, or even by all current and past employees of a company is insecure. Check who has access to your shared drives today and remove access where it is no longer required. Set up the appropriate permissions for your team members that are currently active and make sure that business records are not stored in personal Google accounts. The tool itself is not the problem, the way in which access is set up is.
How can I keep customer records organized without hiring an IT team?
First, determine where all of your current records are being stored. Choose a CRM to begin to organize all of your test results instead of emailing out results to others. Tools like LemonLime connect to the business software you already use — HubSpot, QuickBooks, Google Workspace — and automatically structure that information into a knowledge layer your team can actually access and reason over, without any technical setup. For water filtration installers, organizing residential data at job sites is far more practical to building a system for a records system from scratch.
Tags: water filtration installers · customer data privacy · water quality records · small business data security · residential well data · data handling for home services
Frequently Asked Questions
Does my water filtration business actually have to follow data privacy laws if I only have a few hundred customers?
Yes, you may already cross key thresholds without realizing it. Many state consumer privacy statutes — modeled on California's CCPA — apply to businesses collecting personal information from state residents, and mid-sized installers with a few hundred residential customers often meet those thresholds. Speak with a local attorney to confirm your obligations. LemonLime helps you organize and control exactly what records you hold and who can access them.
What specific information in my customer files is considered sensitive enough to protect?
More than you might expect. A customer's name, address, well type, contamination findings, health concerns, and recommended remediation steps together create a detailed profile of someone's home and health environment. That combination is what makes water quality records sensitive — not just the test result alone. LemonLime structures this information into a controlled knowledge layer so only the right people on your team can access the right records.
How do I find out if my team's old emails and shared drives are exposing customer water test data?
Start with a simple inventory: list every place a test result has ever been saved or forwarded — inboxes, Google Drive folders, CRM notes, scanned PDFs, personal phones. Most installers who do this find three to four uncontrolled exposure points immediately. LemonLime connects to your existing tools like HubSpot and Google Workspace and consolidates that scattered information into one structured, permission-controlled layer.
Can a former employee of my installation company still access customer records after they leave?
If you haven't removed their access, almost certainly yes. Shared drive links, CRM logins, and email threads don't expire automatically when someone leaves. This is one of the most common and avoidable exposure points for small installation businesses. LemonLime supports role-based access so you can ensure only current, authorized team members see customer records — and that access is easy to revoke when someone moves on.
If a customer asks me to delete their water quality records, am I required to do it?
In several states — including California, Colorado, and Virginia — individuals have a legal right to request deletion of their personal data held by businesses. Whether it applies to you depends on your state and customer base. What matters practically is whether you can actually locate and delete that data quickly. LemonLime gives your records the structure needed to respond to those requests efficiently, rather than scrambling through scattered folders and email threads.
How do I set a record retention policy for water test results when I don't know how long I'm supposed to keep them?
Your state may set a minimum, and your warranties or service agreements may require a specific period too. Beyond that, keeping enough history to support future service calls is a legitimate business reason for retention. The key is writing down a defined period and actually deleting or archiving records when it expires — indefinite retention creates its own liability. LemonLime helps you maintain organized, dated records that make applying and enforcing a retention policy realistic.