Data security

How we protect your data

Practical controls for the client data you share with us, described honestly. We only claim what we can show.

Our controls

Role-based, least-privilege access: staff see only the clients they work on
Multi-factor sign-in on every system that holds client data
Access removed promptly when work ends or staff leave
We work in your own accounting software wherever possible, and agree any other tool with you before client data goes into it

Data encrypted in transit (TLS) and at rest by our storage providers
Files shared through secure links, never by personal email
This website is hosted on secure Cloudflare infrastructure, with encryption in transit (HTTPS/TLS) and at rest

Processes designed with Sri Lanka's Personal Data Protection Act No. 9 of 2022 in mind
GDPR-aware: we can sign a data processing agreement when we process personal data for UK or EU clients
Work is done from Sri Lanka, so client data is accessed from here. For UK and EU clients we agree the transfer safeguards the law requires, for example standard contractual clauses, in the data processing agreement
If we become aware of a personal data breach affecting your data, we will tell you without undue delay

Certifications: we do not claim certifications we do not hold.

Security contact: [email protected]. See also our privacy policy.

Ask us anything before you share data. We're happy to sign your NDA first.