Access starts with a role, narrows to the records that role needs, and changes when responsibility changes. Requests, evidence, and review history stay attached to the work.
Scope: Every entity record they own
Modify Institution's internal review records
Security here is less about a wall of badges and more about making access, evidence, ownership, and review explicit in the work itself.
Every access decision starts from the record and the role, not the person. When a team member is staffed on an account, access is scoped to that work. When the responsibility ends, access is reviewed and removed.
Client documents are tied to a named request, purpose, owner, and completion state. Evidence stays connected to the work it supports instead of disappearing into an email thread.
A staffing change, client-side role change, or professional handoff triggers an access review before the next recurring cycle. Open requests are reassigned to a named owner.
A tax professional, counsel, or specialist receives only the evidence package required for the engagement. There is no standing access to the live operating record.
Select a stage to see how documents, ownership, and review stay connected instead of becoming separate threads.
A request records what is needed, why it is needed, who owns the next action, and its current state. The request becomes the container for the evidence and review that follow.
People rotate, providers change, and responsibilities move. The operating history should not disappear with them.
A person rotates off an account, a client-side role changes, or an external engagement ends.
The role-to-record scope is checked before the next recurring cycle and access that is no longer needed is removed.
Requests in flight move to a named owner so the work does not sit without responsibility.
Request history, review records, and reporting packs persist independently of the people who created them.
We describe how we operate rather than publishing certifications we do not hold.
Access is granted to people staffed on your account. Onboarding and offboarding are documented events, not a change in a shared login.
We prefer delegated access and provider-issued invitations over shared passwords. Where shared credentials are unavoidable, they are stored in a business password manager, not in email or shared documents.
Client records and workpapers are held in the accounting software of record, such as QuickBooks Online or Xero, and in Institution's internal systems, which encrypt data in transit and at rest.
Bank, card, and payroll integrations use each provider's official read-only mechanisms whenever available. Write access is limited to the specific tasks it is granted for.
A licensed tax professional, counsel, or specialist receives a bounded evidence package built for the engagement and returns work into a defined request.
Only the documents and context required for the engagement.
Work moves through the client's approved channel.
Completed work returns into a named request.
External professionals do not receive standing access to browse the client's live operating record.
These commitments apply to how Institution handles client financial information in the operating workflow.
We do not sell client data.
We do not use client financial data to train third-party AI models.
We do not store bank credentials outside sanctioned provider integrations or a business password manager.
We do not send financial statements or credentials over unencrypted channels.
Send the control, questionnaire, or access question you need us to address.