People
- Confidentiality agreements with your firm and with every team member.
- Background checks before joining.
- Training on confidentiality and data handling, refreshed every year.
Access
- Named logins for every person. No shared passwords.
- Multi-factor authentication on every system that supports it.
- Least-privilege access: each person sees only the clients they work on.
- Access removed the same day an engagement or role ends.
Where the work happens
- Your shared folder. We normally work in a shared folder you provide (OneDrive, Box, Dropbox, Google Drive or similar), with access configured entirely by your firm or the client.
- No local copies. Nothing is saved to local folders on our devices that are not connected to that shared folder.
- Your systems. Ledger and tool work happens inside your clients’ systems through named logins.
- Secure remote desktop for enterprise clients. We can work on your remote desktop, accessed through an agent on our devices, so files never leave your environment.
- Device restrictions on request. USB storage and personal email are not blocked by default; we block them for your work if you require it.
Contract
Confidentiality, data handling, data return and deletion are written into the engagement letter, together with any requirements your firm or regulator sets.
Frequently asked questions
Do your staff download client data?
No. We work inside the client's ledger and a shared folder you provide, such as OneDrive, Box, Dropbox or Google Drive, with access configured by your firm or the client. Nothing is stored in local folders on our devices that are not connected to that shared folder.
Can you work on our own remote desktop?
Yes. For enterprise clients we can work on a secure remote desktop, accessed through an agent installed on our devices, so files never leave your environment.
Do you block USB storage and personal email?
Not by default. We can block them on the devices that work on your files if your firm or client requires it; we agree this in the engagement letter.
What happens when an engagement ends?
We remove our access the same day, return or delete any files we hold as the engagement letter specifies, and confirm in writing.
Does using an offshore provider breach client confidentiality?
Not in itself, but your firm should follow the professional and regulatory rules that apply to it, such as getting client consent or having a confidentiality agreement in place. Read our guide on client confidentiality when you outsource.
General information only, not legal, tax, audit or professional-conduct advice. Rules, standards and software features change, so confirm the position that applies to your firm before you act. See our disclaimer.
