Your Data, Guarded Like
Our Reputation Depends on It
Because it does. Handing financial data to an offshore team is the biggest objection in this industry — so instead of vague reassurances, this page lists the actual controls we run. Bring it to your IT team; we're happy to be questioned.
How Protection Is Built In
ISO 9001 Certified Quality
Documented, audited quality management across every process — from onboarding checklists to the layered review pyramid that keeps error rates below 1%.
SOC 2-Aligned Practices
Security, availability and confidentiality controls modeled on the SOC 2 framework: access management, change control, monitoring and incident response.
GDPR Adherence
Documented data processing agreements for UK/EU clients, data minimization, defined retention periods and support for data subject rights.
Encryption Everywhere
TLS encryption for all data in transit; encryption at rest for stored documents. No financial data ever travels by unsecured email or paper.
Role-Based Access
Your data is visible only to your named team. Access is granted per engagement, reviewed quarterly, and revoked the day someone rotates off your account.
Bound Confidentiality
Every team member signs enforceable confidentiality agreements before touching any client data — and works on hardened, monitored workstations.
The Controls Behind the Certificates
Certifications describe intent; controls describe practice. These run on every engagement, every day.
Payment fraud prevention
- Segregation of duties on all payment workflows
- Dual-approval payment runs — we never move funds unilaterally
- Vendor master change controls with bank-detail verification
- Anomaly flags on duplicate or unusual invoices
Data handling
- Client data stays in your systems under your ownership
- Secure client portal for all document exchange
- No local copies beyond documented working needs
- Complete audit trail of every action in the portal
Continuity & resilience
- Trained backup on every account from day one
- Documented workflows so no knowledge lives in one head
- Disaster recovery and business continuity plans, tested
- Redundant connectivity and power at delivery centers
The Questions Your IT Team Will Ask
Where is our data physically stored? +
Primarily in your own cloud accounting systems (QuickBooks, Xero, Odoo, etc.) and your document storage — under your ownership and your region’s hosting. Our portal and working files use encrypted cloud infrastructure with documented retention limits.
Can you sign our security questionnaire or DPA? +
Yes — we regularly complete client security questionnaires and sign data processing agreements, NDAs and confidentiality undertakings as part of onboarding.
How do you screen your staff? +
Background verification at hiring, enforceable confidentiality agreements, security training at induction and annually, and role-based access that limits every person to the accounts they serve.
What happens to our data if we leave? +
Nothing dramatic — because it was always yours. Your books live in your systems; we hand over working files and documentation, then certify deletion of any residual working copies per the agreed retention terms.
Have you ever had a data breach? +
No. And the honest answer to “how do we know it stays that way?” is: controls, not promises — the segregation, encryption, access reviews and audit trails on this page exist precisely so that no single failure can become a breach.
Want the full security documentation?
We'll share our security overview pack, sign your NDA and complete your vendor questionnaire — before you commit to anything.