Last updated January 2025

We are committed to safeguarding the data you provide and share with us. We have organisational and technical processes and procedures in place to protect your information. We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal and/or Business Information we process.

Our servers are protected ‘round the clock’ by firewalls, detecting and eliminating malware, hacking and DDoS attacks. We use SSL certificates to ensure that data sent between our servers and you is strongly encrypted. Our servers and data are regularly backed up. We use strong passwords, Multifactor Authentication (MFA) for our Services, and all the data that we store is encrypted.

By integrating with accounting software like Xero, QuickBooks Online and Sage Online, we provide a secure and seamless experience while maintaining robust data protection principles.

However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. Although we will do our best and continually review our policies to protect and your information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

Our framework distributes and maintains the cloud space for our customers. Each customer's service data is logically separated from other customers' data using a set of secure protocols in the framework. This ensures that no customer's service data becomes accessible to another customer.

The service data is stored on our servers when you use our services. Your data is owned by you. We do not share this data with any third-party without your consent.

When you share access to your data on third-party sites, for example Xero, QuickBooks Online and Sage Online, we take every care to protect your data. When accessing your shared data we:

You can revoke our access to your data at any time.

In transit: All customer data transmitted to our servers over public networks is protected using strong encryption protocols. We mandate all connections to our servers use Transport Layer Security (TLS 1.2/1.3) encryption with strong ciphers, for all connections including web access and API access. This ensures a secure connection by allowing the authentication of both parties involved in the connection, and by encrypting data to be transferred. This prevents eavesdropping and any modification of the encrypted data.

At rest: Sensitive customer data at rest is encrypted using 256-bit Advanced Encryption Standard (AES). The data that is encrypted at rest varies with the services you opt for. We provide additional layers of security by regularly rotating the encryption keys.

We operate a zero trust model. This allows us to react to and counter threats that originate from both outside and inside our network. We employ the following principles:

We monitor and analyse information gathered from services, internal traffic in our network, and usage of devices and terminals. We record this information in the form of event logs, audit logs, fault logs, administrator logs, and operator logs. These logs are automatically monitored and analysed to a reasonable extent that helps us identify anomalies such as unusual activity in employees’ accounts or attempts to access customer data. We store these logs in a secure server isolated from full system access, to manage access control centrally and ensure availability.

We run regular backups to protect all data. Backup data is stored in the same geographical location and encrypted using AES-256 bit algorithm. All backed up data are retained for a minimum period of six months. All backups are scheduled and tracked regularly. In case of a failure, a re-run is initiated and is fixed immediately.

In the event that your data needs to be restored, our recovery procedures ensure your data can be restored with minimal disruption.