Security & Data Protection

Our approach

A&M Offshore Accounting handles other people's financial records. This page describes how A&M approaches access, documents and client data, and it says plainly what is not claimed. Specific security controls applicable to an engagement can be documented during vendor due diligence, and the written engagement agreement governs.

• Access that the client or firm controls, and can revoke
• No online banking usernames or passwords
• Client-controlled QuickBooks permissions
• An approved secure method for sensitive documents, not ordinary email
• Access limited to personnel authorised for the engagement
• A plain list of what is not claimed

Access control

A&M's approach is least privilege: people get the access the work needs, and no more. Where possible, access is provided through user or accountant permissions inside the client's or firm's own accounting system, controlled by the client or the CPA firm. A&M will work within a CPA or accounting firm's approved systems where appropriate.

Access is limited to personnel authorised for the engagement, and can be reduced or withdrawn by the client or firm at any time.

Banking credentials

A&M does not require clients to provide online banking usernames or passwords. Work is performed using statements and approved accounting-system access.

If you are asked for online banking credentials by anyone offering bookkeeping, that is worth questioning.

QuickBooks and accounting-system access

Access should be granted by the client or firm using proper user or accountant permissions in the accounting system, controlled by them and capable of being revoked. A&M asks for the permission level the agreed work needs.

Revoking access does not depend on A&M: the client or firm can do it directly, without notice to or consent from A&M.

Secure document exchange

Sensitive financial documents, such as bank and credit-card statements, account numbers and tax identifiers, should be exchanged through an approved secure method. Ordinary email is not the preferred method. The workflow is:

1. At the start of an engagement we agree a transfer method with the client or firm.
2. The preferred route is a secure channel the firm or client already approves, such as the firm's own client portal or file-sharing system, or documents attached within the accounting system.
3. Access to a shared location is granted to named people authorised for the engagement and can be removed by the client or firm.
4. How long shared documents remain in place follows the engagement agreement.
5. Secure document-transfer arrangements can be established after initial contact. Please do not send statements, account numbers, tax identifiers or passwords through the website forms.

Who has access

• Client files are worked on by A&M's in-house team: employees of the company, under the founder's supervision, working from its office in Abbottabad, Pakistan, on company computers.
• The founder reviews client work before it is delivered.
• Access is restricted to personnel authorised for the engagement.
• Client work is not subcontracted to third parties.

Device security

Controls that A&M can state as in place:

• Client work is performed on company computers at A&M's office.

Data storage

• Where client files are held for an engagement, and for how long, is agreed with the client or firm and can be documented during vendor due diligence.
• Where a QuickBooks Desktop file has to be transferred, it moves by the secure method agreed for the engagement.

Data retention and deletion

Retention and deletion terms are set in the engagement agreement, subject to any legal or record-keeping requirement. When an engagement ends, access is revoked by the client or firm and information is returned or deleted as the agreement provides.

Engagement termination

1. The client or firm removes A&M's access to the accounting system.
2. A&M hands over the file, reports and working documentation in the format the next provider needs.
3. Remaining copies are returned or deleted according to the engagement agreement, subject to any legal retention requirement.
4. On request, A&M can confirm in writing that this has been done.

Incident response

If A&M becomes aware of an incident affecting client information, such as a lost device or unauthorised access to an account, its intention is to contain the incident, establish what was affected, tell the affected client or firm directly, support their own response and notification obligations, and record what was learned.

The notification period and cooperation terms are set in the engagement agreement. A&M does not offer guarantees on this page that it cannot support.

What A&M does not claim

A&M does not currently hold SOC 2 or ISO 27001 certification, and does not claim HIPAA, GDPR, CCPA or any other regulatory certification or compliance. It is a founder-led company, not a certified security vendor.

If your firm's policy requires a certified or insured vendor, please check that before you proceed. We would rather you know in the first conversation than in month four.

Specific security controls applicable to an engagement can be documented during vendor due diligence.

Questions and requests

Firms carrying out vendor due diligence can request the vendor information pack. For anything else, email moinmalik@amoffshore.com. Please do not send client documents by email.

Request Vendor Information   Confidentiality & NDA →