Review the controls
that protect client information
SecureWire holds client records and ledgers, with an HMRC connection. Here is how that information is protected: what is in place in the product today, and what our independent security review will confirm.
In the product today
Each of these is in the product today.
- Two-factor sign-in for every member of staff
- Files and sensitive data encrypted
- About 49 adjustable permissions
- Each practice’s data separated inside the database
- An audit trail that cannot be edited or deleted
Review the controls and outstanding details
Where a topic depends on final hosting or legal documentation, it is marked, and confirmed once the independent security review completes.
Two-factor sign-in
Two-factor sign-in is mandatory for every practice and business user, with no opt-out.
- Use an authenticator app, an emailed code or recovery codes.
- Clients use a one-time email link for the portal.
Encryption
Files and sensitive data are encrypted, with encryption in transit and at rest.
- HTTPS protects browser traffic and TLS protects database connections.
- Stored files use AES-256 encryption. Sensitive fields use AES-256-GCM with keys specific to the practice and purpose.
Roles and permissions
Each practice can adjust about 49 permissions from recommended role defaults.
- Owner, Admin, Manager, Reviewer, Staff, Contractor, Auditor and Client roles.
- Auditors have read-only access. Staff see only assigned clients. Contractors work only on assigned engagements.
Audit trail
An audit trail that cannot be edited or deleted. Each entry is hash-chained to the previous entry.
- The database refuses edits and deletions.
- History includes Verify integrity, event filters and CSV export.
- Each client and engagement also has an audit view.
Separation between practices
Each practice’s data is separated inside the database.
- Database row-level security enforces separation between practices.
- Team roles and assignments limit access to client work.
Client portal
Clients open secure links or use a one-time sign-in email.
- Uploads belong to named document requests.
- Messages are marked internal or for the client.
Second-person checks
Work and financial items have second-person approval checks.
- Preparers cannot approve their own work.
- If only one person can approve, that exception is recorded.
Data erasure
Personal data is pseudonymised on erasure and the audit trail is kept.
- Legal sign-off of the erasure approach remains to be confirmed.
CSV export
Export practice reports, financial reports and History to CSV.
- Client lists can also be exported.
Data protection documentation
Confirmed at security reviewDetails to be confirmed at security review.
Hosting and data location
Confirmed at security reviewDetails to be confirmed at security review.
Backups and recovery
Confirmed at security reviewDetails to be confirmed at security review.
Certifications
Confirmed at security reviewDetails to be confirmed at security review.
Independent security testing
Confirmed at security reviewDetails to be confirmed at security review.
Topics marked “Confirmed at security review” describe our approach. Final controls and wording are published once the independent review completes. Ask us for the current documentation during your evaluation.
Report a security concern
If you believe you have found a vulnerability in SecureWire, email us with the details. Please do not include client data in your report.
Tell us what your team needs from accounting software
Register interest in SecureWire and ask us about the modules you need.