Data security and confidentiality
You are handing over bank access. Here is exactly what happens to it.
Most security pages are reassurance without detail. This one is specific, because if you are in another country sending financial credentials to a firm you have not met, vague comfort is worth nothing. Everything below is what we actually do, and where a control has a limit we say so.
Access
We take the least we can do the job with.
The most common security failure in outsourced bookkeeping is not a breach. It is a provider holding more access than the work requires, for longer than the engagement lasts.
How we take access
- Through your software's own user permissions, never a shared login
- At the lowest permission level that completes the work, not administrator by default
- Read only on bank feeds wherever the platform supports it
- Named individual accounts, so every action in your ledger is attributable to a person
- Multi factor authentication enabled on every account that offers it
- Documented at onboarding, so you have a written list of what we hold
What we never ask for
- Your bank login or online banking password
- Card numbers, CVVs or payment credentials
- Authority to move money, initiate payments or approve transfers
- A shared account password used by multiple people
- Access to systems outside the scope of the engagement
If someone asks you for online banking credentials to do your bookkeeping, that is a reason to end the conversation, with us or with anyone else.
Handling
Where the data sits while we work.
Financial records move through fewer places than you might expect, and we keep the list short on purpose.
Storage
Your records stay in your accounting platform. We work inside it rather than exporting your ledger into systems of ours. Working files that must exist locally are kept on encrypted drives.
Credentials
Every credential sits in an encrypted password manager with multi factor authentication. Nothing is stored in email, spreadsheets, chat messages or notes.
Transfer
Documents are exchanged through your platform or an encrypted link. If you send something sensitive by email we will ask to move it, because email is not a secure channel and we will not pretend otherwise.
Ending
Access is removed the day the engagement ends.
This is the control most providers are vaguest about, and the one that matters most after you stop working with someone.
- Our user accounts are deactivated in your software on the final day, not eventually
- Credentials are deleted from our password manager, not archived
- Local working files are securely erased once the handover is complete
- You receive written confirmation of what was removed and when
- Everything we built stays with you, inside your own accounts, documented
You do not have to ask for this and you do not have to chase it. If we have finished, we should not still be able to open your books.
Confidentiality
In writing, before you send anything.
We sign first. You should not be sharing financial records on the strength of a friendly email.
What we sign
- A mutual NDA before you share any document or grant any access
- An engagement letter setting out scope, fee and confidentiality obligations
- Firm specific terms if you are an accounting practice and need us behind your brand
Being straight about limits
We are a small firm, not an enterprise vendor. We do not hold SOC 2 or ISO 27001 certification, and we will not imply that we do. What we have is a short, specific set of controls, applied consistently, and a willingness to put them in writing.
If your business requires a certified provider, say so early and we will tell you honestly whether we are the right fit rather than finding out at the wrong moment.
Questions
Security questions.
Do you need our online banking password?
Who at Finnovia can see our data?
Where is our data physically stored?
What happens if we stop working with you?
Will you sign an NDA?
Are you certified to a security standard?
See also: our privacy policy, and how we work with international clients.
