Accounting provider data residency: where records go and who can access them

Ask an accounting provider to show where your records go during the work. Start with a bank statement or payroll report and follow it through upload, processing, staff review, document storage, and the final accounting file. Include exported spreadsheets and support attachments. A statement about the location of the main database answers only one part of this question.

Build the map around the records you will actually share. Employee payroll detail, supplier bank information, contracts, and company registration papers may need different access restrictions. The FTC recommends knowing what sensitive information a business holds and limiting collection to what it needs. Apply that approach to the engagement: agree which fields are necessary and whether a summarized or redacted version can do the job.

Ask where primary records and backups are stored, where support and accounting staff may access them, and which other companies process them. Keep these answers separate. A provider may store data in one region while authorized staff review it elsewhere. Whether a particular arrangement meets your contractual or legal obligations requires review of the actual facts and applicable requirements.

Get the answer in writing for the service and plan you intend to use. A regional option advertised for one product may not apply to document extraction, email support, or connected reporting tools. Ask what happens if you change plans or enable an optional feature. Your operations team needs to know which actions would move the engagement outside the arrangement that was approved.

Request a role description for the assigned accountant, reviewer, support team, and company administrators. Ask how staff obtain access, who approves it, and how access ends when someone leaves the team. Discuss exceptional access for troubleshooting. A statement that only authorized people have access is incomplete until you know who authorizes them and what each permission allows.

Use an approved demonstration with test records to check the boundary. A person assigned to one entity should see only the entities and records their role permits. A client viewer may need reports without payroll detail. Ask how the provider records access changes and investigates a reported problem. Keep the test within the account and environment you are authorized to evaluate; there is no need to probe other customers' records.

Some accounting workflows extract information from receipts or use an assistant to answer questions. Ask which provider receives the document or question, what accompanying context is sent, how long it is retained, and whether it can be used for model training. Distinguish the provider's own service from the underlying processing service. Request the terms that apply to your account rather than relying on a general marketing promise.

Consider what happens to an uploaded payroll report. An accountant may need gross wages and liabilities while an extraction system receives the entire file. Ask whether fields can be limited and whether optional processing can be disabled without interrupting the agreed service. Treat this as part of the original data map, with its own purpose and access decision, so later feature additions do not bypass the review.

Define which records the company will receive and in what usable format: ledger exports, statements, reconciliations, supporting schedules, correspondence, and unresolved questions. Request a sample export and have the incoming or internal accountant open it. A folder of screenshots may preserve appearance while losing the detail needed to reconstruct account balances or respond to a later inquiry.

Ask which copies the provider retains after the engagement ends, why it retains them, who can access them, and when they are deleted. Backup handling, professional obligations, contractual retention, and legal holds may require separate answers. Have the appropriate adviser resolve conflicting requirements. Do not promise immediate deletion of every copy without checking the actual agreement and relevant recordkeeping duties.

Maintain a short register of approved locations, processors, roles, and open issues. Assign a company owner who receives change notices and knows when to consult security, privacy, or legal colleagues. NIST's Cybersecurity Framework provides a structure for managing cybersecurity risk; your record should translate that review into decisions about these accounting records and these service providers.

Revisit the arrangement when adding an entity, moving payroll into scope, connecting another platform, or changing accountants. Remove unused connections and confirm that old exports remain in approved storage. The decision is ready when your team can explain where its records travel, who can use them, and how it can retrieve them if the relationship ends. Unanswered questions should have a responsible reviewer and a clear resolution date.