Office-based delivery
Client delivery is performed from controlled FinAcct office environments with restricted work areas and physical safeguards.
Security at FinAcct
Security built into every engagement.
Client information moves through defined controls across people, process, technology, and the full data lifecycle—from authorized intake through secure retention or disposal.
FinAcct security model
Protection across every handoff.
Protected focusClient information
Governance & people
Policies, training, confidentiality, and accountable ownership.
Identity & access
Authorized users, least privilege, and MFA where applicable.
Network & devices
Firewalls, managed endpoints, patching, and device policies.
Data protection
Encryption and controlled handling in approved systems.
Monitoring & response
Logging, alerts, investigation, and policy enforcement.
Retention & disposal
Agreed retention, approved transfer, and secure disposal.
Confidentiality
Authorized access
Integrity
Controlled changes
Availability
Operational continuity
Trust
Responsible stewardship
How we operate
Controlled environments. Accountable people.
Our operating practices extend security beyond technology—from where work is performed to how access is approved, reviewed, and removed.
Confidentiality starts before access.
Every employee signs confidentiality and non-disclosure commitments before receiving access to client information.
NDA & confidentiality
Every employee signs confidentiality and non-disclosure commitments before receiving access to client information.
Approved access only
Access is granted by role and engagement need, approved by authorized owners, and protected with MFA where applicable.
Managed workstations
Client work is performed on company-managed devices governed by security, patching, and peripheral policies.
Training & oversight
Employees receive security training and work within documented procedures, manager review, and escalation paths.
Access lifecycle
Access is reviewed when responsibilities change and removed promptly during employee offboarding.
Data lifecycle
Protected from intake to disposal.
A clear operating path replaces scattered handoffs. Each phase has a defined security purpose and remains subject to engagement-specific requirements.
- 01–04Pillar 1
Receive
Accept client information through approved, protected channels.
- 01
Approved sources
Accept data only from authorized client sources.
- 02
Encrypted transfer
Use protected SFTP, VPN, or TLS channels.
- 03
Intake validation
Confirm source, scope, and access before processing.
- 04
Handling requirements
Apply agreed confidentiality and handling rules.
- 01
- 05–08Pillar 2
Control access
Limit access to authorized people, devices, and systems.
- 05
Network boundaries
Restrict connectivity through managed network controls.
- 06
Role-based access
Align permissions to role and engagement need.
- 07
Strong authentication
Apply MFA and approved sign-in controls where required.
- 08
Managed endpoints
Use managed devices with security and patching controls.
- 05
- 09–12Pillar 3
Protect the work
Safeguard information throughout controlled financial processing.
- 09
Device controls
Restrict ports, USB access, and peripherals.
- 10
Approved tools
Use approved software, browsers, and resources.
- 11
Encryption
Protect data at rest and in transit.
- 12
Secure processing
Limit sensitive-data use to trained staff.
- 09
- 13–16Pillar 4
Monitor & close
Monitor activity, retain appropriately, and dispose securely.
- 13
Logging & detection
Monitor activity, threats, alerts, and policies.
- 14
Incident response
Investigate, escalate, and respond through procedures.
- 15
Retention review
Follow engagement and legal retention requirements.
- 16
Secure disposal
Transfer or dispose securely when retention ends.
- 13
Defense in depth
Five control families. One operating model.
Controls work together across administrative, technical, network, physical, and data practices.
Administrative
- Security policies and background checks
- Confidentiality and staff training
- Access approvals and onboarding or offboarding
Technical
- Managed endpoints and device restrictions
- Encryption and MFA where applicable
- Regular patching and approved software
Network
- Firewalls and controlled connectivity
- Access restrictions and web filtering
- Threat monitoring and applicable segmentation
Physical
- Secure offices and restricted work areas
- CCTV and physical security controls
- Clean-desk and paper-minimization practices
Data
- Need-to-know access to sensitive information
- Approved storage, retention, and secure disposal
- Audit trails, logging, and secure transfer
AI governance
Responsible AI, with human accountability.
AI use follows the same confidentiality, authorization, and review expectations as the rest of our delivery model.
How we use AI
- Use approved AI tools for non-sensitive tasks
- Sanitize inputs and protect client confidentiality
- Review and monitor output before use
- Follow internal rules and client authorization
What we do not do
- Place confidential client data into public AI tools
- Use unapproved tools or train AI on client data without authorization
- Allow unchecked decisions or bypass human review
- Use AI to bypass security or engagement controls
Engagement-specific controls come first.
Client requirements guide security and privacy controls, approved tools, access, transfer, retention, and review expectations.
Next step
Ready to Build a Better Accounting Operation?
Whether you're growing, replacing your current accountant,or need a more dependable finance partner.We're ready to help.
A short conversation about your business. No pressure, no one-size-fits-all pitch.