Data security
Sending client information outside your firm is the first thing partners ask about. Here is exactly how we handle it.
Controls
Every engagement begins with a signed confidentiality agreement covering both the firm and the individual assigned to you. Access is granted per client and withdrawn when the work ends.
In practice
How it works
Where you prefer, we work directly in your software under logins your firm issues and controls, so data never leaves your environment.
You know who is assigned to your firm. Access is not shared across a pool, so every action on a file traces back to an individual.
When work ends, access is withdrawn and client data is removed from our side. Nothing is kept for reference.
If your firm runs a vendor security review, send it across. We would rather work through it before an engagement than during one.
The objection
A CPA firm does not own most of the data it holds. It holds it on behalf of clients who never agreed to it going anywhere else, which makes any outsourcing decision a client-confidentiality decision before it is a cost decision.
That is the right way round. We would rather answer a security questionnaire before an engagement than be asked mid-season why a file is sitting on a machine nobody can identify.
Common questions
Wherever your policy says it should. Our default is to work inside your systems, under logins your firm issues and can revoke, so client files never leave your environment at all.
Named individuals assigned to your firm, and only for the clients they are working on. Access is not pooled across a team, so every action traces back to a person.
Access is withdrawn and any client data held on our side is removed. We do not retain files for reference or for future work.
Yes, at both firm and individual level. If your agreement has specific clauses on data location or retention, send it across before we scope the work.
Yes. Send the questionnaire and we will complete it as part of scoping rather than after an engagement has already started.
Next step
We would rather answer it up front than halfway through an engagement.
No obligation. A partner replies, not a sales team.
