How your clients’ data is protected
When we recruit and place an accountant in your team, these are the controls in place.
The controls we operate
- NDAs and confidentiality agreements
- Every accountant signs an NDA and confidentiality agreement before they see any client information.
- Named accounts and role-based access
- Your accountant uses their own named user account in each system, with access limited to what the role needs. No shared logins.
- No local storage of client data
- Work is done inside your cloud software. Client data is not downloaded to or stored on local devices.
- Multi-factor authentication
- MFA is used wherever your systems support it.
- Backup internet and backup power
- Every placed accountant has two internet connections plus mobile data, and backup power, so local outages don’t interrupt your work.
- Your firm reviews and signs off
- Offshore staff prepare the work. Your qualified staff review it, sign it off and make all HMRC submissions.
Access set-up for a dedicated accountant
Illustrative example. You decide the access in your own systems.
| System | Access level | MFA |
|---|---|---|
| Bookkeeping software (for example Xero) | Named user, assigned clients only | On |
| Practice management | Named user, assigned jobs only | On, where supported |
| Document portal | View and upload, assigned clients only | On, where supported |
| Email and chat | Firm account, no forwarding to personal accounts | On |
| HMRC agent services | No access. Submissions stay with your firm | Not applicable |
| Client bank accounts | No access. Bank feeds are read in the software | Not applicable |
UK GDPR and international transfers to Pakistan
Giving someone outside the UK access to personal data counts as a restricted transfer under UK GDPR. Pakistan has no UK adequacy decision, so a transfer safeguard is needed.
We support you with an International Data Transfer Agreement (IDTA) and a transfer risk assessment. Your firm remains the controller, or the processor for your own clients, and should take its own advice on its data protection obligations.
Source: ICO, International transfers: a guide
What we don’t claim
DigiHyre does not hold ISO 27001 or SOC 2 certification. The controls on this page are the ones we operate today.
Your regulator and your clients
- Your firm keeps responsibility for the work and its supervision, as with any member of staff.
- ACCA’s guidance for UK practices on outsourcing and offshoring covers its Rulebook, professional indemnity insurance, data protection, cybersecurity and anti-money laundering. Check your own professional body’s guidance; we’ll provide the information you need for your records.
- Many firms mention offshore support in their engagement letters and privacy notices.
“We may use carefully vetted team members based outside the UK to help prepare your accounts. They work under our supervision, inside our systems, under confidentiality agreements, and your data is protected by appropriate transfer safeguards.”
Questions about security?
Bring your IT or compliance lead to a 20-minute call and we’ll go through your requirements.