> what's a reasonable heuristic for conducting private business?

You need to do a threat analysis.

I did not immediately find any good introductory resources via a quick Google search, but try it yourself. Very very briefly, it involves identifying the threats and their possible consequences, then working on either removing the former or minimising the latter.

Be aware that this is not merely a technological process. It is primarily a social one.