If we ask you to trust a compliance position, the least we owe you is a plain statement of how the data is held, who can reach it, what is already in place and what is not yet. The last part is the one most security pages leave out.
Each client's data is logically separated, and within a client each entity is a boundary of its own. A user granted access to one subsidiary cannot read another, and consolidated views are assembled only for roles explicitly given group scope.
Traffic is TLS-encrypted end to end. Stored data and backups are encrypted at rest, and documents attached as evidence are held in encrypted object storage with access mediated by the application rather than by direct links.
Permissions are defined by role, entity and period. Maker and checker are distinct, authority limits are versioned, and a period that is locked is read-only for everyone including administrators until a reopening is approved and logged.
The edit log is append-only. There is no administrative interface to modify or purge it, no bulk-edit path and no configuration switch to disable it - which is what the audit-trail requirement under the Companies (Accounts) Rules actually asks for.
Security pages tend to blur what exists with what is planned. These are separated deliberately, and the third list is not an omission.
Your books are your statutory obligation. Our job is to hold them in a way that never gets in the way of you meeting it.
Accounting records, tax and filing data, contract documents, statutory registers and the evidence attached to entries. Payroll data includes personal information about your employees, held under your instruction as the controller of that data.
For the statutory retention period applicable to books of account, with legal hold where an assessment, appeal or litigation is open. Deletion requests are honoured for anything outside a retention obligation, and the record of deletion is itself retained.
On request or on exit, as a complete export: masters, transactions, the edit log, and documents in original formats with an index linking each to its entry - structured to stay usable after the subscription ends.
Your users, by role. Our engineers only where support requires it, with a recorded reason and time-bound access. Sub-processors are limited to infrastructure and are listed on request before onboarding.
We would rather answer a diligence questionnaire early and tell you where the answer is no. If a control your policy requires is not in place yet, you will hear that in the first conversation rather than during onboarding.
