The first question every partner asks. Here's our full answer.
Outsourcing lives or dies on data handling. We built our controls before we built our client list — so that when your client asks "where does my information go?", you can answer in specifics, not assurances.
Your engagement letter sets the standard. We operate inside it.
Your firm owes its clients confidentiality under professional standards and PIPEDA. When we work on your files, we treat that obligation as our own — contractually, technically, and culturally. Every control below exists to keep that promise auditable.
People: bound before they begin
Every team member signs a confidentiality and data-handling agreement before touching any client file, undergoes reference checks at hiring, and completes data-handling training as part of onboarding. Work is performed by our employed team in our own office — never subcontracted, never gig-sourced.
Devices: company-owned and encrypted
All work happens on company-owned laptops with full-disk encryption, managed endpoint protection, and automatic screen locking. Personal devices never touch client data. Lost or retired devices are remotely wiped.
Access: least privilege, per engagement
Team members can access only the engagements assigned to them. Access is granted when work starts and revoked when it ends. Multi-factor authentication is enforced on every account, and credentials are managed through an enterprise password manager — never shared in chat or email.
Data flow: inside controlled systems only
Work happens inside your (or your client's) cloud accounting environment and channels agreed with your firm. Client data is not downloaded to unmanaged storage, forwarded to personal email, or moved to consumer file-sharing accounts. What stays in your systems stays under your control.
Office: physical controls
Our team works from our own office with controlled access — not from homes, cafés, or co-working spaces. Screens face inward, visitors don't enter working areas, and clean-desk practice applies to anything client-related.
PIPEDA alignment: designed in
Our handling policies are written against Canadian privacy expectations — purpose limitation, safeguards proportionate to sensitivity, and breach notification commitments to your firm. We support your PIPEDA obligations rather than complicating them.
Our incident commitment
No honest security page pretends incidents are impossible. Our commitment is simple: if we ever identify an incident affecting your firm's data, we notify you promptly with what we know, contain it, document it, and support any notification obligations your firm has. You will never learn about a problem with your data later than we reasonably could have told you.
Ask us the hard questions.
Book a call and bring your security questionnaire. We'll walk through every control on this page in as much detail as you need.
Book a 30-minute intro callFull policy document available on request.