Security & Trust
How we protect the information you trust us with.
Finance work means access to bank feeds, payroll, tax records, and the personal data inside them. This page describes the controls we operate, the frameworks we align to, and how to reach us about any of it.
Our commitments
Five principles that govern how we handle data.
Collect only what the work needs
We ask for the minimum data required to deliver the engagement, and we tell you why we need it.
Least-privilege access
Access to client systems is granted per person, per engagement, and removed when it is no longer needed.
Encryption everywhere
Data is encrypted in transit (TLS 1.2 or higher) and at rest across the platforms we use.
Documented, repeatable controls
Our security practices are written down, reviewed at least annually, and shared with clients on request.
Transparency when it matters
If an incident affects your data, you hear it from us promptly, with facts and next steps.
Your data stays yours
We never sell personal data, never use client data for marketing, and return or delete it when an engagement ends.
Controls
What we do in practice.
Identity & access
Multi-factor authentication is required on every system that holds client data, including email, document storage, accounting platforms, and banking portals. Access is granted on a named-user basis with the least privilege needed. Shared logins are not used. Access is reviewed at least quarterly and revoked immediately when a team member or engagement ends.
Devices & endpoints
Work is performed on managed devices with full-disk encryption, automatic screen lock, current operating system patches, and endpoint protection. Client data is not stored on removable media or personal devices.
Data protection
Data is encrypted in transit using TLS 1.2 or higher and at rest by our platform providers. Client documents are stored in access-controlled, audited cloud storage rather than email attachments. Sensitive identifiers such as full account numbers and Social Security numbers are collected only when legally required and are redacted in working documents.
Vendor management
We rely on a small set of established providers that publish independent security attestations: Wix (website hosting and contact forms), Google Workspace (email, calendar, and document storage), and Intuit QuickBooks Online (accounting). Each is reviewed before adoption and at least annually, and each is bound by a data processing agreement. A current list of subprocessors is available on request.
Incident response
We maintain a written incident response procedure covering detection, containment, assessment, notification, and post-incident review. Clients affected by a confirmed security incident are notified without undue delay and, where GDPR applies, within 72 hours of our becoming aware, with the information needed for your own obligations.
Business continuity
Client data lives in redundant, backed-up cloud platforms rather than on a single device. We document recovery steps so that a lost laptop or an outage at one provider does not interrupt your reporting cycle.
Retention & disposal
Website inquiries are retained for 24 months. Client engagement records are retained for seven years after the engagement ends to meet tax and professional record-keeping obligations, then securely deleted. Any data you ask us to delete sooner is deleted unless a legal obligation requires otherwise.
People
Everyone who touches client data is bound by a written confidentiality agreement and completes security and privacy awareness training when they join and annually thereafter.
Frameworks
How we align to SOC 2, GDPR, and HIPAA.
These frameworks apply to organizations and their practices, not to a website on its own. Here is what each one means for how we work, stated plainly.
SOC 2
Our internal controls are designed and documented against the AICPA Trust Services Criteria for Security, Availability, and Confidentiality. The platforms that store client data (Google Workspace, Intuit, Wix) maintain their own SOC 2 Type II reports, which we review. Clients and prospects can request our control summary and vendor attestations at any time.
GDPR & UK GDPR
For clients and contacts in the European Economic Area or the United Kingdom, we act as a processor for engagement data and a controller for our own business records. We offer a Data Processing Agreement with Standard Contractual Clauses, honor data-subject rights requests within one month, keep records of processing, and collect website data only with a lawful basis. Details are in our Privacy Policy.
HIPAA
When a client is a covered entity or business associate under HIPAA, we sign a Business Associate Agreement before any work begins, limit protected health information to the minimum necessary, and apply the administrative, physical, and technical safeguards of the Security Rule. Financial work rarely requires PHI; where it does, it is handled only through the client's own secured systems, never through this website or email.
Please do not send sensitive data through this website. The contact form is for general inquiries. Do not include account numbers, Social Security numbers, health information, or other confidential records. Once an engagement begins, we provide a secure channel for exchanging documents.
Documents on request
What we can share.
- Information security policy summary
- Subprocessor list and vendor SOC 2 attestations
- Data Processing Agreement (GDPR / UK GDPR)
- Business Associate Agreement (HIPAA)
- Incident response and breach notification procedure
- Completed security questionnaires for your procurement team
Contact
Report a concern.
If you believe you have found a security vulnerability on this website or in how we handle data, please tell us. Email security@glendaloughadvisory.com with enough detail to reproduce the issue. We acknowledge reports within two business days and will not pursue action against good-faith researchers who respect user privacy and give us a reasonable time to fix the problem.
For privacy and data requests, email privacy@glendaloughadvisory.com.
Last reviewed October 30, 2026.