What we hold, why we hold it, and who else sees it.

Last updated 14 October 2026

Who we are

Accounting Tech Ltd is a company registered in England and Wales, number 17377132, with its registered office at 01 Meadlake Place, Thorpe Lea Road, Egham, TW20 8HE. We build and operate AccountantOS. For anything in this notice, write to hello@accountantos.co.uk.

Two roles, and why it matters

Data protection law distinguishes the organisation that decides why and how personal data is used (the controller) from one that handles it on another’s behalf (the processor). AccountantOS involves both, and which one we are depends on whose data it is.

• Your account and this website — we are the controller. Your name, email address, sign-in details, what you do in the service, and anything you send us directly.
• What a practice loads into the service — the practice is the controller; we are its processor. Client company records, bookkeeping pulled from Xero, payroll data pulled from Staffology, uploaded documents, identity checks, and messages synced from connected channels. We handle that data only on the practice’s instructions, under the processing terms in our Terms of service. If you are a client of a practice that uses AccountantOS, the practice is responsible for telling you how your data is used; this notice describes what we do with it on their behalf.

Data we hold as controller

• Account identity — your name, work email address, the practice or company you belong to, your role, and whether you use the service as a practice user or a client user.
• Sign-in security — a one-way hash of your password (never the password), your two-factor authenticator enrolment (stored encrypted; a copy of our database alone cannot produce valid codes), and, where you sign in with Microsoft, the identifier Microsoft gives us for your account. Two-factor authentication is required for every password sign-in.
• Activity and audit records — sensitive actions are logged with who did them and when: sign-ins, changes to bills and tasks, publishing to Xero, access to stored secrets, and similar. These records exist so that a practice can account for what happened in its own data, and so we can investigate a security concern.
• Public forum and roadmap — if you post a feature request or comment, your first name and profile photo are shown beside it publicly. Nothing else about you is published.
• Waitlist and correspondence — the details you give when you join the waitlist or write to us, used only to reply and to tell you about the thing you asked about.
• Technical data — server logs including IP address, browser type and the pages or endpoints requested, kept for security and reliability.

Data practices process through the service

Depending on which modules a practice uses, AccountantOS can process the following about a practice’s clients and their people. The practice decides which of these to connect.

• Bookkeeping and financial data from Xero — bills, invoices, contacts, accounts, trial balances and management figures.
• Payroll data from Staffology — employee names, employee codes, National Insurance numbers, dates of birth, addresses, contact details, bank details, tax codes, pay figures, and pension and auto-enrolment records. This is some of the most sensitive data in the service and is only ever retrieved for the employers a practice has explicitly mapped.
• Documents and files uploaded by a practice or its clients.
• Identity verification where a practice uses the anti-money-laundering module: the checks are carried out by Sumsub, which handles the identity documents and any biometric step; we hold the outcome and the records the practice must keep.
• Messages from Microsoft Teams or Slack channels and mailboxes a practice chooses to connect, so that client conversations can be seen in one place.
• Public company information from Companies House.

Why we use it, and on what basis

• To provide the service you or your practice have signed up for — performance of a contract.
• To keep the service secure and reliable — authentication, rate limiting, audit records, investigating abuse — our legitimate interests, and yours.
• To meet legal obligations, including the record-keeping a practice must do under anti-money-laundering regulations where that module is used.
• With your consent, where we rely on it — for example the waitlist, where we only contact you about what you asked for. You can withdraw consent at any time by writing to us.

We do not sell personal data, we do not use it for advertising, and we do not build profiles of people for marketing purposes.

AI features

Some features send excerpts of data to Anthropic, a provider of AI models, to produce a result: reading the figures off an uploaded bill, suggesting a category, summarising a client’s recent activity, drafting an automation from a sentence you typed, and enriching a prospect from Companies House records. Only the data needed for that result is sent, it is processed under commercial terms that restrict its use to returning a response to us, and the provider is listed as a sub-processor below. AI output in the service is assistance, not advice; the Terms of service say more about that.

Who else sees it — our sub-processors

We use the following organisations to run the service. Each is bound by contract to process data only for the purpose we engage it for. Those marked “if connected” see data only when a practice chooses to connect that service.

• Microsoft Azure — database and file storage.
• Render — application hosting, in its Frankfurt (Germany) region.
• Xero — accounting data, if connected.
• Microsoft 365 — sign-in, mailbox and Teams connections, if connected.
• Staffology (IRIS Software Group) — payroll data, if connected.
• Slack — channel messages, if connected.
• Sumsub — identity verification, if the anti-money-laundering module is used.
• Companies House — public company records.
• Anthropic — AI features, as described above.

We will update this list when it changes and, for practices, give notice of a new sub-processor under the processing terms.

Where data is held, and international transfers

The service is hosted with the providers above. Some of them process data outside the United Kingdom, including in the European Union and the United States. Where personal data leaves the UK we rely on appropriate safeguards recognised under UK GDPR — the UK’s adequacy regulations where they apply, and otherwise the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses with the provider concerned. You can ask us for details of the safeguard that applies to a particular provider.

How it is protected

Data is encrypted in transit and at rest; stored secrets and integration credentials are additionally encrypted at the application layer; every password sign-in requires two-factor authentication; access is controlled to the individual feature and to the specific clients a user is allowed to see; and sensitive actions are logged. We do not claim certifications we do not hold. The Security page sets this out in full.

How long we keep it

• Account data is kept while the account is active and for a short period after it is closed, so that it can be restored if closure was a mistake, after which it is deleted from live systems and cycles out of backups.
• Data processed for a practice is kept for as long as the practice instructs. When a practice’s subscription ends it can export its data, after which we delete it, subject to any legal requirement to retain particular records.
• Audit records are kept for the life of the account they relate to, because their purpose is accountability after the fact.
• Anti-money-laundering records are retained for the period the regulations require of the practice — currently five years from the end of the business relationship — on the practice’s instruction.

Your rights

Under UK GDPR you can ask to see the personal data we hold about you, to have it corrected or deleted, to restrict or object to how it is used, and to receive a copy in a portable form. Write to hello@accountantos.co.uk and we will respond within one month. If your data is in the service because a practice put it there, the practice is the controller: send your request to the practice, and we will help it respond.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather hear from you first.

Cookies

AccountantOS uses only the cookies it needs to work: one that keeps you signed in, one that remembers which client you were looking at, and small preference cookies for how the app is laid out. They are set only when you sign in or change a setting. There are no advertising or third-party analytics cookies on the service or on this website.

Changes to this notice

When this notice changes we update the date at the top. For a change that affects how a practice’s data is processed we give notice under the processing terms. The current version is always at this address.