Account Direct holds financial records for Canadian small businesses and the accountants who serve them. We treat the trust customers place in us as the most important property of the service. The summary below describes the controls and practices that back that trust.
Defence in depth
Authentication, access controls, encrypted storage, and least-privilege internal roles each operate independently. A failure in one layer does not expose the data protected by the others.
Encrypted in transit and at rest
All traffic between your browser and our service is encrypted with TLS. Customer documents and records are encrypted at rest in our database and file storage.
Record-level access controls
Access to your data is enforced at the record level. Each user sees only the information they are entitled to: customers see only their own records, and accountants see only the clients assigned to them. These controls are applied by the platform on every request.
We never train AI on your data
Your business documents are never used to train artificial-intelligence systems. Under our Canadian-only tier (Tier 1), your documents are processed entirely within Canada and never leave the country. Under our cross-border tier (Tier 2), a third-party provider processes them under a contract that prohibits using your content to train its systems.
Regular security reviews
We conduct security reviews of the platform, covering our data model, application code, and processing pipeline. Findings are remediated or tracked to resolution.
Breach notification
A documented breach-response runbook governs how we triage, contain, communicate, and notify regulators in the event of a breach of security safeguards. Notifications align with PIPEDA section 10.1 and Quebec Privacy Act article 3.5 timelines.
Operational practices
- Sign-in sessions encrypted in transit and at rest, and secure password reset
- Hardware-grade authentication signing keys
- Privileged service keys rotated regularly and never exposed to the browser
- Strict Content Security Policy on our public website
- A responsible-disclosure process for reported vulnerabilities
What to do if you spot a problem
If you believe you have found a security vulnerability, please contact us at [email protected]. We will acknowledge within two business days. Please avoid disclosing the vulnerability publicly until we have had a reasonable opportunity to address it.
For privacy questions (data access, deletion, correction), reach our Account Direct Team at [email protected]. See the Privacy Policy for the full set of rights and how to exercise them.
This page is a high-level summary. More detailed security documentation is available to enterprise customers and auditors on reasonable terms, contact [email protected].