Security & compliance
Data sovereignty, client confidentiality and regulatory compliance are the first questions every practice asks about offshoring. Here is exactly how we answer them — before any data changes hands.
Request our security pack01 How we handle your data
Client files are never copied to our machines. Our team connects to your systems, under your access rules, and leaves nothing behind.
We work directly in your environment — cloud ledgers and tax software, a hosted desktop or Remote Desktop, or your firm's VPN. Client files stay on your servers, not ours.
Every account we use to reach your systems is individual, named and protected with multi-factor authentication. No shared logins, no passwords over email.
Delivery staff work from a secure office floor with a strict clean-desk policy, so client information never ends up on paper or on a personal device.
You grant access per client and per person, and you can revoke it at any time. We remove access the same day someone leaves your account.
02 Data security & confidentiality
Your clients' data is the first thing you'll ask about — so these controls are in place before any firm's data reaches our team.
Security documentation available to prospective firms under NDA.
Request documentation03 Regulatory compliance
Offshoring doesn't change your professional obligations — so our handling is designed to keep you compliant in every country we serve.
Section 7216 makes it a criminal offence to disclose tax return information without the taxpayer's consent — and preparing returns offshore requires specific written consent first. We only open a US return once your firm confirms the client's 7216 consent is on file, and we use the information solely to prepare the work you've engaged us for.
Systems we access under your controls
Practice management workflows in TaxDome and Karbon, worked under your firm's user permissions.
Your firm stays the data controller; we act as your processor under a written data processing agreement, with international transfer safeguards in place for work done from India.
Systems we access under your controls
The same processor commitments apply to Irish practices, with transfer safeguards for personal data processed outside the EEA.
We support your obligations under the Australian Privacy Principles, including APP 8 on disclosing personal information overseas.
Systems we access under your controls
BGL CAS 360 and Simple Fund 360 for SMSF administration and compliance work.
We handle personal information to the standard your practice is held to, including Information Privacy Principle 12 on cross-border disclosure.
Systems we access under your controls
Working knowledge of provisional tax calculations, including standard, estimation and AIM methods.
Doing due diligence?
We're happy to complete your vendor security questionnaire, share our policies and answer questions from your IT or compliance team before any data changes hands.
Get in touch
Book a free 30-minute consultation at a time that suits you, or send us a few details about your firm. We reply within one working day.
Or reach us directly
Our hours overlap with yours
Auckland
--:--
Sydney
--:--
New York
--:--
London
--:--
Happy to sign an NDA before you share any details.