Confidentiality is built into how we work.

We protect client data through several layers that work together. Contractually, we sign a mutual NDA, an engagement agreement and, where personal data is involved, a Data Processing Agreement before any data is shared. Organisationally, every team member signs an individual confidentiality undertaking, follows our written Client Data Handling SOP and is assigned only to specific clients. Technically, every person has a unique account protected by multi-factor authentication, access is restricted to the assigned team, and data is stored in encrypted, access-controlled business cloud storage or inside the client's own systems. Operationally, documents are exchanged only through approved channels, work is independently reviewed before delivery, and data is returned or securely deleted at the end of the engagement.

Yes. We sign a mutual NDA with every client before any confidential information is exchanged, including during a pilot. We are equally happy to sign the client's own NDA. In addition, every partner, employee and contractor signs an individual confidentiality undertaking, and we can confirm this in writing for everyone assigned to your engagement.

All systems used for client work are password protected and secured with multi-factor authentication. Access is restricted on a need-to-know basis and reviewed every quarter. Data is encrypted in transit and at rest by our business cloud providers, stored in a separate restricted folder for each client, and never kept on personal devices, personal email or removable media. Where the client prefers, we work only inside the client's own environment through its VPN or virtual desktop, so the data never leaves the client's systems.

Only the named personnel assigned to that client's engagement: typically the assigned accountant, the reviewer and the engagement manager. Each grant of access is approved by the Security Owner and recorded in an access register. Access is reviewed quarterly and is removed the same day a person leaves the engagement or the firm.

In business-grade cloud storage (Google Workspace or Microsoft 365, that is, Google Drive or OneDrive) in a dedicated folder for each client with sharing restricted to named individuals, or directly inside the client's own systems when the client prefers. Public or "anyone with the link" sharing is not permitted.

No. Financial and personal data is exchanged only through channels agreed with the client in writing: the client's portal or system, a restricted cloud folder, or business email for correspondence. Our public WhatsApp number is used only for first enquiries and never for documents. If a document arrives by an unapproved route, it is not used for work; we ask the client to resend it through the approved channel and delete the stray copy.