Security & data governance
Your clients’ data deserves better than “100% secure”.
Every outsourcing provider says their systems are secure. Here is the specific list of controls we operate, what each one actually does, where your client records physically live, and where your obligations under the Privacy Act 2020 sit.
Control summary
At a glance- Storage
- SharePoint, New Zealand tenant
- Identity
- Named accounts, MFA enforced
- Access
- Role-based, scoped to the job
- Devices
- Managed and encrypted only
- Offshore
- Remote access, no local copies
- Backup
- Versioned, restore tested
- Offboarding
- Access revoked same day
Ten controls, and what each one does.
Written so your IT adviser can assess them properly, rather than so they sound reassuring.
| Ref | Control | Implementation |
|---|---|---|
| S‑01 | Multi-factor authentication | App-based or hardware second factor enforced on every account across Microsoft 365 and every other cloud system, with no exemption path for convenience. Conditional access blocks sign-in from unrecognised devices and locations, and every login is under an individual named account — there are no shared or generic logins anywhere in the environment. |
| S‑02 | Client data held in SharePoint | All client records live in a single Microsoft 365 SharePoint tenant hosted in New Zealand. A separate document library is provisioned per engagement, with version history, retention policy and full audit logging of every upload, view, edit and download. Nothing is kept on local drives, personal cloud accounts or email attachments. |
| S‑03 | Privacy Act 2020 | We handle personal information consistently with the information privacy principles. Two bear directly on this arrangement: IPP 12 on disclosure outside New Zealand, and IPP 3A on information collected indirectly rather than from the individual. We give your practice the written detail it needs to meet its own obligations rather than asking it to take our word for it. See privacy obligations. |
| S‑04 | Offshore data disclosure | Our delivery team is in India and reaches the New Zealand-hosted tenant remotely under named accounts. Client data is not copied, replicated, exported or synced offshore. Remote access by an overseas team is still a disclosure under IPP 12, so we document it plainly instead of glossing over it. |
| S‑05 | Staff access controls | Role-based permissions scoped to the active engagement. An accountant can open only the client libraries assigned to their current jobs, and that access is withdrawn when the job closes. Access grants are approved, logged and reviewed on a fixed cycle rather than accumulating quietly. |
| S‑06 | Device controls | Work happens on managed, encrypted company devices only. Downloads to unmanaged devices are blocked by conditional access, USB and removable storage are disabled at the endpoint, printing is restricted, and a clean desk policy applies across the delivery centre. |
| S‑07 | Confidentiality agreements | Binding confidentiality, intellectual property and data restraint terms signed by every staff member before any access is granted, and carried through into our engagement terms with your practice. |
| S‑08 | Backups | SharePoint version history and retention on every client library, plus independent encrypted backup of the tenant with documented recovery objectives and periodic restore testing. See continuity. |
| S‑09 | Breach procedures | A documented five-stage response aligned to the notifiable privacy breach requirements of the Privacy Act 2020. Your practice is told without delay, with what we know at that point, so it can assess and notify in time. See breach notification. |
| S‑10 | Staff access termination | Offboarding triggers same-day revocation: the Microsoft 365 account is disabled, active sessions and tokens are revoked, the device is wiped or returned, and where the person worked on your files we confirm the revocation to you in writing. |
Two privacy duties, and where each one sits.
Your client records stay in our New Zealand-hosted SharePoint tenant, and our delivery team in India reaches them remotely rather than holding copies. Remote access by an overseas team is still a disclosure outside New Zealand, which engages Information Privacy Principle 12. Separately, your practice passes us information about people we never deal with directly, which engages IPP 3A.
We would rather put this in front of you at the start than have it surface in a professional standards review later.
What IPP 12 requires
Under Information Privacy Principle 12, a New Zealand agency may disclose personal information to a foreign person or entity only where it is satisfied that comparable safeguards apply, or where another listed ground is met.
What IPP 3A adds
IPP 3A, added by the 2025 amendments to the Privacy Act 2020, applies where personal information is collected from somewhere other than the individual it is about, and can require that individual to be notified. Your practice passes us end-client information; we never collect it from the individual.
Where we hold that information as your agent — the usual arrangement — section 11 of the Act treats it as held by your practice, and the IPP 3A duty stays with you. Where we would instead be collecting in our own right, the duty is ours. Which of the two applies is settled in the engagement terms rather than left to assumption.
What we do to support it
- All client data held in a Microsoft 365 tenant hosted in New Zealand, with no copies held offshore
- Contractual undertakings requiring us to protect personal information to a standard comparable to the Privacy Act 2020
- Engagement terms that state plainly whether we hold information as your agent or collect it in our own right
- Written detail of where data is stored, who can reach it, and under what controls
- Confidentiality and data restraint terms binding every individual with access
- A named contact for privacy questions and for any request your client makes
- Breach notification to your practice without delay, so you can meet your own obligations
What stays with your practice
- Your privacy statement and engagement terms disclosing overseas processing
- Your assessment that the arrangement satisfies IPP 12
- Any IPP 3A notification owed to individuals whose information you pass to us, where we act as your agent
- Any notification the Privacy Commissioner or an affected person is entitled to
This page describes the controls we operate. It is not legal advice. Your own legal adviser and your professional body’s guidance should confirm how your engagement terms and privacy statement are worded.
If something fails.
Your deadlines do not move because our infrastructure had a bad day. Continuity is planned for and tested rather than assumed.
- SharePoint version history and retention on every client library
- Independent encrypted backup of the Microsoft 365 tenant
- Documented recovery time and recovery point objectives
- Periodic restore testing, because an untested backup is a guess
- Redundant connectivity and power at the delivery centre
- Cross-trained staff, so one person’s absence does not stall your file
- A documented plan for continuing work from an alternate location
If something goes wrong.
A notifiable privacy breach is one that has caused, or is likely to cause, serious harm. Our process is built so your practice can meet its own notification duty in time.
IR 01
Contain
Access suspended and the affected system isolated immediately.
IR 02
Notify you
Your practice is told without delay, with what we know at that point.
IR 03
Assess
Scope, data involved and likelihood of serious harm established from the audit logs.
IR 04
Support notification
We give you what you need for the Privacy Commissioner and affected people.
IR 05
Remediate
Root cause fixed, controls changed, and a written report back to you.
Want your IT adviser to interrogate this?
Good. Book a security briefing and bring them. We will walk through the control list, the data flow and the contractual position in detail.