IT Support for HVAC Companies: A Houston Guide for Field Crews

Step 1 protects the one application that holds the customer list, the schedule and the money.

Multi-factor authentication (MFA) is a second proof of identity, such as a phone prompt, required after the password. For a Houston HVAC or trade contractor, the field-service platform holds customer names, home addresses, job history and invoices, so every login needs MFA and the admin list needs one named owner.

The platform might be ServiceTitan, Housecall Pro, Jobber or FieldEdge. Whichever one runs the business, treat it the way an accounting firm treats its tax software. A stolen technician password opens the same customer records the owner sees, and a stolen admin password can change where payments settle.

Phishing is the usual way those passwords leave the building. Pistachio's Phishing Behaviour Report 2026 measured simulated phishing across 648 organizations and reported a cumulative 12-month click rate of 45.74% in Construction and Real Estate, against a cohort average of 31%. The report does not break out HVAC or other trades separately, so read the construction figure as the nearest measured neighbor.

ServiceTitan's help center documents two-factor verification through its Azure Active Directory integration. The article lists administrators as the audience and says to contact ServiceTitan Technical Support to start the integration. Other platforms handle the second factor in their own settings, so the first task is to open the admin console and read what is switched on today.

• Give each person a named login. A shared "dispatch" or "tech2" account hides who did what and cannot be closed when one person leaves.
• Turn on MFA for every role, starting with owners, office managers and anyone who can edit payment or payroll settings.
• Keep the admin list short and assign one person to review it on the first of each month.
• Connect the platform to the company's Microsoft 365 sign-in where the vendor supports it, so one disabled account closes several doors.

The wider Houston picture supports starting here. CinchOps' Houston Area Security Index scored 4,393 businesses across 5 industries on external security signals, and 49.6% earned a D or F. The index does not score trade contractors as their own group, so treat that figure as the metro baseline a contractor's own setup gets measured against.

Step 2 covers the device in the truck, which is also the cash register.

Mobile device management (MDM) is software that lets a company set rules on every tablet and phone it issues, then lock or erase a device from the office. An HVAC technician's tablet carries the customer list and takes card payments, so each one should be enrolled in MDM before it leaves the shop.

A tablet left on a condenser pad in The Woodlands is a customer-data incident unless the office can lock it within minutes. With mobile device management, the same console that pushes the field-service app also enforces a passcode, keeps the device encrypted and wipes it when a technician reports it missing.

Card payments raise the stakes. The PCI Security Standards Council states that PCI DSS is intended for "all entities involved in payment card processing - including merchants" and for any entity that stores, processes or transmits cardholder data. A contractor that takes a card in a customer's driveway is a merchant under that wording, whatever its size. PCI DSS v4.0.1 has been the only active version of the standard since v4.0 was retired on 31 December 2024.

The practical rule for a field crew is short. Cards go through the processor's reader or the payment screen inside the field-service app, and nowhere else. Card numbers typed into job notes, read over an open phone line into a spreadsheet, or photographed "to run later" pull the whole tablet, and the office network behind it, into the scope of the standard.

MDM makes that rule enforceable. The office decides which apps a tablet may run, blocks personal email from holding work files and removes company data from a personal phone without touching the technician's photos. In 35+ years doing this, the cost of a lost device has come less from the hardware than from nobody being able to say what was on it.

Step 3 keeps the phones and the schedule running on the days Houston customers need a contractor most.

Dispatch uptime means the phones ring, the schedule loads and technicians receive jobs even when the office has lost power or internet. A Houston HVAC contractor gets there with a cloud phone system, a second internet path at the office and a tested plan for dispatchers to work from another location.

Houston adds a calendar problem that contractors in most other markets do not face. The summer service peak, roughly June to September, falls inside the Atlantic hurricane season, which the National Hurricane Center says runs from June 1 to November 30 with its peak on September 10. The weeks with the fullest dispatch board are the same weeks the office is most likely to go dark.

Hurricane Beryl showed the scale. The Public Utility Commission of Texas reported that the storm, which made landfall on July 8, 2024, disrupted service for 2.7 million customers, including 2.2 million CenterPoint customers. Every one of those homes without power was also a home without air conditioning in July, and many of them called a contractor the hour the lights came back.

A contractor whose phones sit on a box in the office closet cannot answer those calls. Three pieces close the gap:

• A cloud phone system. VoIP lets the main number ring on a dispatcher's laptop or mobile app from any location with power.
• A second internet path. CinchOps builds SD-WAN across redundant service providers, such as 5G data and Starlink alongside the primary line, so one carrier outage does not close the office.
• A written dispatch-from-elsewhere plan, naming which dispatcher takes a laptop home before landfall and tested once before June 1.

The field-service platform is already hosted in the cloud, which helps. The schedule survives an office outage on its own. What fails is the path between a ringing phone and a person who can book the job, and that path is what this step protects.

Step 4 closes the accounts that steps 1 and 2 opened, on a date set the day the person starts.

Offboarding is the removal of a departing worker's logins, email, phone access and company devices. A Houston trade contractor that adds seasonal technicians should record an end date on each new account on day one, then disable the field-service login and wipe the tablet on that worker's last day.

Seasonal work makes this harder than it sounds. A technician hired in May may leave in September, return next April and work two weekends in between. Accounts stay open "in case he comes back", and by the third summer the user list is longer than the payroll.

Texas already asks HVAC companies to keep one roster straight. The Texas Department of Licensing and Regulation states that contractors who install, repair or maintain air conditioning, refrigeration or heating systems must hold a TDLR license, and that ACR companies must employ an ACR contractor in each permanent location. A company that tracks who is licensed to touch a system can track who is allowed to open the customer list with the same discipline.

Run the season as one checklist with three stops. On hire day the technician gets a named login, MFA, an enrolled tablet and an end date on the account. Mid-season, role changes update access and lost tablets get reported the same day. On the last day the login is disabled, email and phone access are removed, the tablet comes back and is wiped, and any shared passwords are changed. A returning technician gets a fresh account, which takes minutes.

Whoever runs payroll should trigger the last-day stop, because payroll always knows the final shift. CinchOps builds that handoff into its employee IT onboarding and offboarding service so the request arrives before the truck keys do.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area. CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10 to 200 employees.

For an HVAC, plumbing or electrical contractor, that work follows the same 4 steps: logins, tablets, dispatch and offboarding. The published CinchOps rate is a flat $100 to $250 per user per month on Zero-Zero-Zero terms, which means no long-term contracts, no hidden fees and no cancellation penalties.

• With managed IT support, help desk requests are answered in under 15 minutes during office hours, so a technician locked out of a tablet at a customer's door gets back to work.
• CinchOps' cybersecurity service adds 24/7 threat monitoring and MFA across email and the accounts that connect to the field-service platform.
• Mobile device management enrolls each technician tablet and phone, and locks or wipes a lost one from the office.
• VoIP and SD-WAN keep the dispatch line and the office connection up on a second path.
• Business continuity planning keeps immutable, verified backup copies offsite for the files that live outside the field-service app.
• CinchOps supports contractors across Houston, Katy and Cypress, alongside its work for construction companies and energy and utilities contractors.

General contractors face a related set of questions, covered in the 7 non-negotiables for Houston construction IT providers and the IT checklist for Houston construction companies.

If summer hires are starting soon, do step 4 first and work backward. An old login costs nothing to close today and a great deal to explain after a customer's address list turns up somewhere it should not be. Print the user list, then talk to CinchOps about the rest.