Security & information handling
Your financial information, handled deliberately.
Bookkeeping requires access to sensitive information. This page explains what we may ask for, why, how access should be controlled and the principles we follow. It describes our intended approach; specific tools and controls will be listed here once they are confirmed.
What clients may share
What we ask for, and why.
| Information | Why it’s needed |
|---|---|
| Accounting software access | To categorise transactions, reconcile accounts and close the month. |
| Bank, card and payment-processor statements or feeds | To reconcile every account to an independent record. |
| Bills, receipts and invoices | To support transactions and, where in scope, manage payables and receivables. |
| Payroll reports from your payroll provider | To record each payroll run correctly, if payroll coordination is in scope. |
| Loan, lease and asset documents | To keep balance-sheet accounts accurate. |
What we won’t ask for
Some things never needed.
- Your online banking passwords or login credentials
- Full card numbers or security codes
- Patient, client or other personal health records
- Sensitive documents through website forms or ordinary email
Data-handling principles
How access is controlled.
Least access needed
We request only the access a task requires — read-only feeds where your platforms support them, and user-level access to your accounting software rather than shared logins.
You stay in control
Your accounts and accounting file are intended to remain in your business’s name. Payments are released by authorised people at your business, and you can remove our access at any time.
Documents through a secure workflow
A dedicated document-sharing workflow is set up during onboarding, so files don’t travel by email attachment.
Only what the scope requires
We use client information to deliver the agreed services and nothing else.
A defined handover
When an engagement ends, access is removed and records are handed back as set out in your service agreement.
Onboarding security approach
Access is set up step by step.
- You sign the service agreement before any access is granted.
- We list the systems and accounts the agreed scope requires.
- You invite Sumday as a user in each system, at the lowest access level that allows the work.
- Documents are exchanged through the secure workflow set up for your business.
- Access is reviewed when your scope changes and removed when the engagement ends.
Certifications
Sumday does not claim SOC 2, HIPAA, ISO 27001 or any other security certification or attestation. If that changes, the certification and its scope will be listed here.
A brighter financial future
Let’s build it together.
Tell us about your business and we’ll recommend the right combination of bookkeeping, financial operations and strategic support.
