Client Data Security Q&A
Detailed answers to the questions clients and their auditors ask before sharing financial data with an outsourcing partner. If your question is not answered here, ask us; we will answer it in writing.
Q1. How do you secure client data?
We protect client data through several layers that work together. Contractually, we sign a mutual NDA, an engagement agreement and, where personal data is involved, a Data Processing Agreement before any data is shared. Organisationally, every team member signs an individual confidentiality undertaking, follows our written Client Data Handling SOP and is assigned only to specific clients. Technically, every person has a unique account protected by multi-factor authentication, access is restricted to the assigned team, and data is stored in encrypted, access-controlled business cloud storage or inside the client's own systems. Operationally, documents are exchanged only through approved channels, work is independently reviewed before delivery, and data is returned or securely deleted at the end of the engagement.
Q2. Do you sign an NDA?
Yes. We sign a mutual NDA with every client before any confidential information is exchanged, including during a pilot. We are equally happy to sign the client's own NDA. In addition, every partner, employee and contractor signs an individual confidentiality undertaking, and we can confirm this in writing for everyone assigned to your engagement.
Q3. How do you protect client financial data?
All systems used for client work are password protected and secured with multi-factor authentication. Access is restricted on a need-to-know basis and reviewed every quarter. Data is encrypted in transit and at rest by our business cloud providers, stored in a separate restricted folder for each client, and never kept on personal devices, personal email or removable media. Where the client prefers, we work only inside the client's own environment through its VPN or virtual desktop, so the data never leaves the client's systems.
Q4. Who can access client data?
Only the named personnel assigned to that client's engagement: typically the assigned accountant, the reviewer and the engagement manager. Each grant of access is approved by the Security Owner and recorded in an access register. Access is reviewed quarterly and is removed the same day a person leaves the engagement or the firm.
Q5. Where do you store client documents?
In business-grade cloud storage (Google Workspace or Microsoft 365, that is, Google Drive or OneDrive) in a dedicated folder for each client with sharing restricted to named individuals, or directly inside the client's own systems when the client prefers. Public or "anyone with the link" sharing is not permitted.
Q6. Do you use personal WhatsApp or other unsecured methods for financial documents?
No. Financial and personal data is exchanged only through channels agreed with the client in writing: the client's portal or system, a restricted cloud folder, or business email for correspondence. Our public WhatsApp number is used only for first enquiries and never for documents. If a document arrives by an unapproved route, it is not used for work; we ask the client to resend it through the approved channel and delete the stray copy.
Q7. How do you maintain confidentiality?
Through a confidentiality-first way of working: NDAs and individual undertakings, need-to-know access, secure systems, documented SOPs, segregation of each client's data, clean-desk and locked-screen practices, and regular awareness training for the team. Confidentiality obligations continue after an engagement ends and after a person leaves the firm.
Q8. What is your client data workflow?
Client data is received through the approved channel and logged; stored in the client's restricted folder; processed by the assigned accountant according to the engagement checklist; independently reviewed and signed off; delivered through the approved channel with confirmation recorded; retained for the agreed period; and then returned or securely deleted with written confirmation. The full procedure is published as our Client Data Handling SOP.
Q9. Do you follow GDPR and other data-privacy laws?
Yes. In India we comply with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023. For international clients we act as a processor or service provider and sign the terms they need: Article 28 processor terms with Standard Contractual Clauses or the UK Addendum for EU and UK data, CCPA service-provider terms for California, and contractual protections supporting the Australian Privacy Principles, UAE and Saudi PDPL and Canada's PIPEDA. In practice this means data minimisation, purpose limitation, restricted access, secure handling and deletion at the end of the engagement.
Q10. What happens if there is a security incident?
We follow a written incident-response procedure: we contain the incident immediately, assess what data and which clients are affected, notify affected clients without undue delay and within the contractual deadline (our standard commitment is 72 hours), report to CERT-In where Indian law requires, help the client make any notifications it must make under its own laws, and record the root cause and corrective actions in a post-incident report.
Q11. What happens to our data when the engagement ends?
We hand over any work in progress, return or securely delete all client data from every location, revoke all access on the same day, update the access register and confirm deletion to you in writing. Data is kept beyond that only where the law requires it, and it remains protected while it is kept.
Q12. Can we audit you or send a security questionnaire?
Yes. We answer vendor-security questionnaires accurately and support our answers with evidence where available, such as the access register extract for your engagement, signed undertakings, and our policies under NDA. We also issue a periodic data-security attestation letter for your engagement on request.
Q13. Why should we trust FinEx with financial data?
Because confidentiality is designed into how we work rather than added on: written agreements before any data is shared, a documented SOP, need-to-know access with MFA, secure storage, independent review, a tested incident procedure, and a leadership team with more than 35 years of combined experience handling sensitive financial information. We also welcome a short pilot so that you can evaluate our quality, communication and security in practice before committing.
Questions about security?
We are happy to complete your vendor-security questionnaire and walk your team through our controls.