A layered security framework — physical, logical, people, and engagement controls — designed to meet the expectations of U.S. CPA firms and the requirements of Indian law.
Aligned with ISO/IEC 27001 controls and the security expectations under the U.S. FTC Safeguards Rule, IRS Publication 4557, and Indian IT Rules, 2011 and DPDP Act, 2023.
Our Information Security team maintains a documented incident-response plan covering identification, containment, eradication, recovery, and post-incident review.
In the event of a confirmed security incident materially affecting a partner firm's data, we commit to:
Wherever possible, our team accesses your environment via VPN / RDP / VDI, so client data remains within your perimeter — we view but do not extract.
Data leaves your environment only when explicitly required for processing (e.g., tax-preparation software input) and is held in encrypted form, with access limited to the engagement team.
We request only the data needed for the engagement scope. Out-of-scope data is returned or securely destroyed in accordance with the agreed retention schedule.
Limited to essentials (secure hosting, communication, professional advisors). A current list is available on request and updated changes are notified to partner firms in advance.
Right-to-audit provisions are available in our MSA on request. We are willing to complete partner-firm security questionnaires and provide evidence of controls.
Daily encrypted backups, documented business-continuity and disaster-recovery procedures, and periodic restoration testing.