Client financial data should be handled with scoped, platform-level access — never full account ownership or a banking password — limited retention of working files, and offboarding that takes minutes, not a negotiation. Handing a provider access to your financial accounts is a real trust decision, not a formality — and for tax preparers it’s a legal one, since the FTC Safeguards Rule requires a written information security program; here’s what that standard looks like in practice, whether or not you end up working with RazaPro specifically.
Access should be scoped, not total
A provider doing reconciliation and categorization work doesn’t need full ownership of your accounting software account, and shouldn’t ask for your online banking password directly. Look for a provider that uses your accounting platform’s own permission system — accountant-level or staff-level access — so you control exactly what they can see and do, and can revoke it instantly from your own settings.
Ask what’s actually being stored
A bookkeeping engagement generates working files: exported reports, reconciliation notes, filing drafts. A reasonable provider limits what it retains to what’s needed to support the current or immediately prior filing period — not an indefinite archive of your full financial history sitting in someone else’s inbox or drive.
Offboarding should be simple, not a negotiation
At the end of an engagement, revoking access should take you minutes through your own platform’s settings — because the provider never had more than scoped, platform-level access in the first place. If ending a relationship with a bookkeeping provider requires them to “confirm” they’ve deleted your data from systems you can’t see into, that’s a sign the access model wasn’t scoped tightly enough to begin with.
The IRS lays out the same principles for tax professionals in Publication 4557, Safeguarding Taxpayer Data, including limiting access to what each person needs and securing how client information is stored and shared.
Questions worth asking any provider before you hand over access
- What level of access do you need, specifically, in my accounting software?
- Do you ever ask for banking login credentials directly?
- What do you store outside of my own accounting platform, and for how long?
- How do I revoke access if I want to end the engagement?
- Is anything shared over plain email that should go through a more secure channel?
A provider that can answer these clearly and specifically — not with a generic “we take security seriously” — is one worth trusting with financial access.
How RazaPro handles this
RazaPro’s own access model follows the principles above: client-controlled, platform-level access scoped to the engagement, limited retention of working files, and revocation handled directly through your own software’s permission settings. Read the full breakdown on the security page, or book a free consultation if you have specific questions about how this would work for your business or firm.