Information Security Controls

1. Purpose and scope

FinEx Tax Advisory handles financial statements, tax returns, payroll records, bank data and personal information on behalf of businesses and accounting firms in India, the United States, the United Kingdom, the United Arab Emirates, Saudi Arabia, Australia and Canada. The purpose of this policy is to protect the confidentiality, integrity and availability of that information, and to make sure our clients can meet their own legal, regulatory and professional obligations when they work with us.

The policy applies to all partners, employees, trainees, interns and contractors of the firm (together, "personnel"); to all devices, accounts and systems used for firm work; and to all client information in any form, whether electronic, paper or verbal. Where a client contract sets a stricter requirement than this policy, the stricter requirement applies to that engagement.

2. Governance and accountability

Information security is owned at partner level. A designated partner acts as the Security Owner and is accountable for this policy, for the access register, for approving exceptions and for leading the response to any incident. The partners review this policy at least once a year, and also whenever there is a significant change in the services we offer, the countries we serve, the systems we use or the laws that apply to us.

• Risk review. At onboarding we record each client's systems, data types, channels, retention period and any jurisdiction-specific requirements. Higher-risk engagements, such as US tax return preparation or payroll containing national identifiers, receive additional controls agreed in writing.
• Exceptions. Any departure from this policy must be approved in writing by the Security Owner, must be time-limited and must be recorded in the exceptions log with the reason and compensating controls.
• Policy set. This policy is supported by our Client Data Handling SOP (FX-SOP-01), Acceptable Use Policy, Incident Response Procedure, Access Control Procedure and Data Retention Schedule.

3. People security

Most data incidents in professional-services firms begin with a person, not a system. Our people controls are therefore applied before a person joins, while they work with us and when they leave.

• Before joining. Identity verification, verification of qualifications and previous employment, and reference checks appropriate to the role.
• Confidentiality undertaking. Every person signs an individual confidentiality and non-disclosure undertaking and our Acceptable Use Policy before receiving access to any client information. These obligations continue after the person leaves the firm.
• Induction and awareness. New personnel are taken through this policy, the Client Data Handling SOP, phishing awareness and the rules for handling taxpayer and personal data. Awareness reminders are repeated during the year and before busy seasons.
• Need-to-know assignment. Personnel are assigned to specific client engagements. They have no access to clients they do not work on.
• Disciplinary process. Breach of this policy is treated as a serious disciplinary matter and may lead to termination and legal action.
• Leaving the firm. All access is removed on or before the last working day, firm devices and documents are returned, and the person is reminded in writing of their continuing confidentiality obligations.

4. Identity and access management

Access to client information follows the principle of least privilege: each person receives only the access needed for their assigned work, for as long as they need it.

• Unique accounts. Every person uses an individual account for email, cloud storage, accounting software and client systems. Shared or generic logins are not permitted.
• Multi-factor authentication. MFA is required on email, cloud storage and every accounting, tax or payroll platform that supports it. Where a client system supports MFA, we ask the client to enable it for our users.
• Password standards. Long, unique passwords stored in an approved password manager. Passwords are never written down, shared, sent by email or stored in documents.
• Access register. The Security Owner maintains a register of who has access to which client and which system, with the date access was granted and the approver.
• Periodic review. Access is reviewed at least every quarter and whenever a person joins, leaves or changes engagement. Access that is no longer needed is removed immediately.
• Working inside client systems. Where a client prefers, our team works only inside the client's own environment through the client's VPN, virtual desktop or accountant-user access. In this model client data does not leave the client's systems, and the client can see and control our access at all times.

5. Devices and endpoints

• Firm work is performed only on approved, firm-managed devices with a supported operating system, automatic security updates, full-disk encryption where available, endpoint protection and an automatic screen lock.
• Client information must not be stored on personal devices, personal cloud accounts or removable media such as USB drives and external hard disks.
• Local downloads of client files are avoided. Where a temporary local copy is unavoidable for processing, it is deleted as soon as the task is complete.
• Lost or stolen devices must be reported to the Security Owner immediately so that accounts can be secured and the incident procedure started.

6. Data protection and secure communication

• Approved channels only. Client documents are exchanged only through channels agreed at onboarding: the client's portal or system, a restricted cloud folder created for that client, or business email for correspondence. Personal email accounts, personal messaging apps (including WhatsApp) and public file-sharing links are not used for financial or personal data.
• Encryption. Data is encrypted in transit using TLS, and our business cloud providers encrypt stored data at rest.
• Segregation. Each client has a separate, access-controlled folder structure. Data from different clients is never mixed in the same folder, workbook or email thread.
• Data minimisation. We request only the data needed for the agreed work. Excess data received in error is returned to the client or deleted, and the client is informed.
• Clean desk and screen. No client papers are left unattended. Printing is limited to what is essential, and printed material is shredded after use. Screens are locked whenever a workstation is unattended.
• Retention and disposal. Data is kept only for the period agreed in the client contract or required by law. At the end of that period, or on the client's instruction, it is returned or securely deleted, and deletion is confirmed in writing.

7. Physical security

Our office in Worli, Mumbai is accessible only to personnel and accompanied visitors. Visitors do not have access to workstations or documents. Firm devices are not left unattended in public places, and confidential conversations are not held where they can be overheard.

8. Third-party services

We use established business platforms for email, cloud storage, communication and accounting. Before adopting a platform we review its security and privacy terms, and we use the security features it offers, including MFA, restricted sharing and audit logs. A list of the platforms used on an engagement is provided to the client on request, and clients may require that we work only in systems they nominate.

9. Logging, monitoring and continuity

• Sign-in, sharing and file-activity logs available from our cloud platforms are retained and reviewed when there is any indication of misuse.
• Backups and redundancy are provided by our cloud platforms. Work is organised so that a reviewer or engagement manager can continue any engagement if an individual becomes unavailable, so that deadlines are not missed.

10. Incident management

Every person must report a suspected incident immediately. Incidents are handled under our Incident Response and Breach Notification procedure, which covers containment, assessment, client notification, notification to CERT-In where Indian law requires it, and corrective action.

11. Compliance and review

Compliance with this policy is checked through access reviews, engagement reviews and spot checks by the Security Owner. Findings are recorded and corrected. The policy is reviewed at least annually and updated when laws, client requirements or our services change. Clients may send us their vendor-security questionnaire; we answer it accurately and support our answers with evidence where available.