How we protect your data and your clients’ data.
The controls, agreements and practices behind every engagement, set out so a compliance reviewer can check them.
Agreements
- An NDA with you before any data is shared.
- Confidentiality clauses in every LedgerShore employment contract.
- A data processing agreement, available on request.
Access
- Least-privilege access: each person sees only what their role on your engagement needs.
- Credentials you provision and control, in your own systems.
- Multi-factor authentication on every system we use for your work.
- Access removed within 24 hours when someone leaves the engagement or the engagement ends.
People
- Security and confidentiality training at joining and every year after.
Devices and workspace
- Work is done on company-managed laptops with full-disk encryption, USB storage and printing disabled.
- The team works from an access-controlled office with a clean-desk policy and CCTV.
- Client data is never stored on personal devices or local drives.
Incident response
- If we detect a security incident affecting your data, we notify you within 24 hours.
- We tell you what happened, what data was involved, and what we are doing about it.
Our standard confidentiality statement
The wording we put in proposals and engagement letters.
Every LedgerShore team member signs a confidentiality agreement and completes security training at joining and every year after. We work through accounts you provision, protected by multi-factor authentication, on company-managed laptops with full-disk encryption, USB storage and printing disabled. Client data is not stored on personal devices.
We only publish controls we operate today. If your IT or compliance team wants to check any of them, ask for our security overview and we’ll walk through it with you.
Security questions
Where is our data stored?
In your systems. We work inside software you provision, so your data stays where you already keep it. We don’t copy client files into our own storage.
Can you complete our vendor security questionnaire?
Yes. Send it with your inquiry or after the NDA is signed, and we’ll return it with supporting evidence.
Can we audit your controls?
Yes. We can walk your IT or compliance team through our controls on a call, and share our security overview and policies under NDA.
What happens to access when an engagement ends?
All access is removed within 24 hours, and we confirm it to you in writing.