Security

01Our approach

We hold trade licences, identity documents, bank statements and complete accounting records for the businesses we work with. We treat that as a serious responsibility rather than a checkbox, and we keep our security practices deliberately simple enough that they are actually followed.

02Access control

Access to client records is restricted to the people working on that engagement. Accounts are individual, never shared, and multi-factor authentication is enabled on the systems that hold client data.

When someone stops working on your account, their access to it is removed.

03Encryption

Data is encrypted in transit using TLS across our website and the systems we use. Documents at rest are held in reputable hosted platforms that provide encryption at rest as standard.

04Document handling

Documents you send us — whether by email, WhatsApp or upload — are moved into our working systems and are not left sitting in personal inboxes or on personal devices.

WhatsApp is convenient and we use it because clients prefer it, but it is operated by a third party under its own security model. If you would rather send sensitive documents another way, tell us and we will arrange it.

05Systems and providers

We rely on established accounting, storage, reporting and communication platforms rather than building our own. We choose providers with a credible security track record, and we keep the number of systems holding client data deliberately small.

06Retention and deletion

Tax and accounting records are retained for a minimum of seven years, as UAE tax legislation requires. Material that is not subject to that obligation is deleted when it is no longer needed.

Retention is covered in more detail in our Privacy Policy.

07People

Everyone working with client data is bound by confidentiality obligations that continue after they stop working with us. Access is granted on the basis of what a person actually needs to do their work.

08If something goes wrong

If we become aware of a security incident affecting your data, we will investigate it, contain it, and tell you what happened, what was affected and what we are doing about it. Where the law requires notification to a regulator, we will make it.

09Reporting a concern

If you believe you have found a security issue with our website or systems, please tell us at the address below rather than disclosing it publicly. We will acknowledge your report and keep you updated while we look into it.

10What we ask of you

Security runs both ways. The things that help most:

• Send documents through the channels we have agreed with you.
• Tell us promptly if someone leaves your business and should no longer have access to shared files.
• Be wary of any message claiming to be from us that asks you to change payment details — we will never ask you to redirect a payment by message alone.
• Keep your own copies of the records you send us.