Your clients’ data, treated the way you’d expect.
AccountantOS holds financial and personal data for practices and their clients, so security isn't a bolt-on. UK-hosted, GDPR-aligned, encrypted in transit and at rest, access controlled down to the feature — with sensitive actions logged.
How your data is protected.
The essentials, done properly — where your data sits, how it's encrypted, and who can reach it.
Your practice and client data is hosted in the UK, keeping it close to home and aligned with UK data-protection expectations.
Data is encrypted on the wire and in storage, so it's protected both while it moves and while it sits.
Built to align with UK GDPR — lawful handling, data-minimisation and clear routes to export or delete on request.
Client secrets — portal logins, references, codes — are encrypted with your practice key, separate from ordinary records.
Permissions distinguish practice users from client users and reflect company roles, down to the individual feature.
Client users only ever see their own entities — never another client's data.
The right people, the right data, on the record.
Access is granted by role and by feature, and scoped so clients only see themselves. Behind that, sensitive actions — publishing a bill, revealing a vault secret or an API credential, editing an automation — are logged, so there’s always an answer to “who did what, and when”.
Connected by OAuth, not stored passwords.
Connections use OAuth authorisation, so we don't store passwords for them — and access can be revoked at the source at any time.
Accounting data flows through an OAuth connection you authorise and can revoke — no Xero password is ever held by us.
Registered details and filing deadlines come from Companies House via authorised access, not scraped or re-keyed.
Sign-in and mailbox connections use OAuth with Microsoft 365, so authentication stays with your identity provider.
Export or deletion, whenever you ask.
Request an export of a client’s data, or its deletion, and we’ll act on it — in keeping with UK GDPR and your own obligations as a practice.
We describe our practices honestly and don’t claim certifications we don’t hold. Security is continuous work: we align with UK GDPR today and are working towards recognised information-security standards. If you need specific documentation for your own due diligence, get in touch and we’ll share what we can.
Read the documentation →Security your clients can trust you with.
UK-hosted, encrypted and access-controlled — run your practice on a platform built to look after sensitive data.