Before access
Confirm confidentiality terms, approved systems, user roles, data locations, retention expectations and escalation contacts.
Information handling
Security begins with fewer assumptions and clearer New Zealand engagement controls.
We prefer specific access, transfer, review and offboarding controls over unsupported certification claims. The exact security schedule is confirmed in writing for each client.
A smaller access footprint creates a clearer control environment.
01
Named accounts and MFA
Use individual accounts and multi-factor authentication wherever the client’s Xero and connected systems support them.
02
Least privilege
Limit access to the New Zealand entities, modules and actions necessary for the assigned workflow.
03
Separation of duties
Preparation access should not automatically include payment release, Inland Revenue filing or administrator rights.
04
Approved communication channels
Agree where records, queries, credentials and completed deliverables may be shared.
Engagement control map
Security across the full New Zealand workflow lifecycle.
During delivery
Use agreed channels, named access, visible query logs, senior review checkpoints and deliberate lock-date controls.
When scope changes
Remove unnecessary access, transfer open items, confirm retention or deletion instructions and document completion.
Engagement-specific controls: Access permissions, approved systems, file-transfer methods, retention expectations, confidentiality terms and offboarding steps are confirmed before confidential New Zealand records are exchanged.
Public website boundary
The enquiry form is not a client document portal.
Visitors are explicitly asked not to submit Inland Revenue records, identity documents, bank statements, payroll files, passwords or client data through the public form.
Discuss security early
Start securely