Your systems. Your keys. Our controls, written down.
We work inside your platforms, with the lowest access the job needs. You stay the administrator and you release every payment. These rules go into the engagement letter we both sign, not only on this page.
The same access rules for every client
You invite us, and you remove us
Named logins with multi-factor sign-in, in systems you administer. Remove a login and our access ends that minute.
We prepare payments; you release them
Pay runs and payment files wait for your approval in your own bank. We have no bank login.
No banking or government logins
We never hold myGov, ATO, PRODA, myplace or internet banking access, even view-only.
The full rules are below, and go into the engagement letter we both sign.
Access
- One named user per person, with the lowest role the job needs and multi-factor login on
- You are the administrator: you invite us and you remove us
- Invitations, never passwords. No password by email, phone, text or chat
- An access register for each client, reviewed with you every quarter
Where we work
- A remote desktop hosted in an Australian region, or your own
- Local drive, clipboard, printing and USB redirection turned off
- Data stays in your systems or our Australian-region tenant
- Nothing is saved on our own devices
Logins we never hold
- myGov, myID, ATO, RAM, PRODA or myplace
- Internet banking, even view-only
- Payment-release rights in payroll or bill-payment tools
- Admin rights after setup is finished
Money
- You approve every pay run and release every payment
- Bank details change only through employee self-service and a call-back to you, never because of an email
- For migration agents, we are never a signatory and never move money
Data
- Only the data the job needs, above all for NDIS participants
- No AI tool used on your data without your written permission
- Free checks use IDs rather than names, Australian-region upload links and no email attachments, and are deleted at 30 days
Incidents and exit
- Written notice within 24 hours of becoming aware of a breach
- When you leave, access is removed and your data returned or deleted within 5 business days, confirmed in writing
- Records are never withheld for unpaid fees
A written plan before any data moves
Security plan
Before an engagement starts, you get our written information security plan. For US firms it is mapped to IRS Publication 5708 and the FTC Safeguards Rule (16 CFR 314.4), with a data protection addendum alongside the services agreement.
Payroll accuracy
If we find an underpayment, we tell you in writing within two business days, and we never carry a known underpayment into the next pay run. Late or short super goes to you and your agent the same day.
What we never do, in Australia or the US
Australia
- We are not a registered tax agent or BAS agent
- We never prepare or lodge BAS or tax returns for businesses that engage us directly
- We don't decide GST treatment, PAYG withholding or super guarantee compliance; your registered agent does
- We never deal with the ATO on your behalf
- For accounting firms, we prepare work only for the firm's review and lodgment under its own registration
United States
- We never file returns, e-file or represent clients before the IRS or a state
- No tax return preparation for the 2027 filing season; clerical support only, with §7216 consents and masked SSNs
- Financial statements are for management use: not audited, reviewed or compiled, and no assurance is expressed
- We never hold or move client money