Security and confidentiality
Confidentiality is a professional duty before it is a technical one. This page explains how we protect your information, and what you can do on your side.
A professional duty first
Accountants see what most outsiders never do: bank statements, payroll, tax positions, the terms of a sale, the affairs of a family. Keeping that information confidential depends first on how people behave, and only then on the technology they use.
That is why every engagement is covered by a written confidentiality agreement, why only the partner and team assigned to you can open your files, and why we keep a few deliberate habits: documents through an encrypted portal rather than email, software kept in your name, and no more access than the work requires. This page describes each of them, and what you can do on your side.
How we protect your information
Arrangements that apply to every engagement, from a single tax return to a complete finance function.
A written confidentiality agreement
A written confidentiality agreement is in place for every engagement, so the obligation to keep your affairs private is set down in contract rather than left to habit.
Access limited to your team
Within Pi, your files can be opened by the partner and team assigned to you and by no one else. When someone's assignment to your engagement ends, so does their access.
An encrypted client portal
Documents pass between us through an encrypted client portal, not as email attachments, which keeps them in one place and away from forwarding chains, crowded inboxes and mistyped addresses.
Your systems, in your name
Accounting software and other subscriptions stay in your name. We work in them as users you have authorised, so your ledgers remain under your control, and you can see our work, or remove our access, whenever you choose.
Only the access the work requires
We ask for the least access our work needs: view-only where viewing is enough, and administrator rights only for tasks that require them, such as setting up or migrating a system. When an engagement ends, our access to your systems, bank feeds and portals is removed.
Used only for your engagement
What you share with us is used for the work you have engaged us to do. It is disclosed outside the engagement only with your consent, or where the law or our professional obligations require it.
Professional obligations
Commitments and protections that apply to every client in the same way.
A written engagement letter
What we will do, and what we need from you to do it, is set out in a written scope and engagement letter agreed before any work begins.
Partner review
A partner reviews every deliverable before it is released to you, so nothing leaves the firm without a second, senior check.
Professional indemnity
Professional indemnity insurance is in place for the professional work we carry out.
Identity verification
Before work begins, we verify who each client is and who its beneficial owners are, as part of our anti-money-laundering checks. The documents you provide are held under the same confidentiality as everything else.
Independence
Independence rules prevent us from auditing a company whose books we keep. If we keep yours, your auditor will be another firm.
What you can do
Much of the protection that matters sits in arrangements you control.
- Keep software subscriptions, bank feeds and other services in your own name, and give each of us our own user account rather than sharing yours.
- Grant role-based access: the user role each person's work needs, with view-only access to bank accounts where viewing is enough.
- Send documents through the client portal rather than email, particularly identity documents, bank statements and payroll records.
- Keep the authority to release payments with your own signatories.
- Where a system allows only one login, change the password whenever the people or firms using it change.
- Before acting on an unexpected request to change bank details or make an urgent payment, confirm it by telephone with someone you know.
- Tell us when someone leaves your business or your approvers change, and review the users on your systems from time to time.
Information about other people
Much of what we handle concerns people other than you: employees on your payroll, customers and suppliers in your ledgers, patients in a medical practice's billing, or the clients of an accounting firm. It is covered by the same agreement and the same limits on access, and we use it for nothing beyond the work you have engaged us to do.
We contact your employees, customers, suppliers or clients only where the engagement requires it and you have agreed. For engagements that involve patient information, see medical billing; for the arrangements we make with accounting firms and their clients, see working with accounting firms.
Questions
Can anyone else at Pi see our files?
No. Only the partner and team on your engagement can open your files, and anyone who leaves that team loses access.
Why do you ask us not to use email?
Because an email, once sent, is out of either side's control: it can reach the wrong person, be forwarded, or sit in several inboxes for years. The portal is encrypted and open only to the people working on your engagement.
Will you need administrator access to our systems?
Only for tasks that require it, such as setting up or migrating software. For routine work we ask for the user role the work needs, and you can change or remove our access at any time.
What happens to our access and records when an engagement ends?
We stop working in your systems, and our user accounts on them are closed. Your software and ledgers were in your name throughout, so your records stay where they are, under your control.
How is information sent through this website handled?
Website enquiries are seen only by the partner and team who deal with them. Our privacy notice explains what the enquiry form collects, why we collect it and the rights you have over it.
Speak with a partner
Every enquiry is read by a partner and answered within one business day. Meetings are held at our offices, at yours, or by video.