1. Data Storage and Protection

• Encrypted Storage: All client financial data is stored on industry-leading cloud platforms utilizing Advanced Encryption Standard (AES) both during transit and at rest.

• Access Control: Access to our servers and databases is strictly limited to authorized personnel and requires Two-Factor Authentication (2FA) and strong, regularly updated passwords.

• Regular Backups: We maintain regular, encrypted backups of all client data to ensure rapid recovery and business continuity in the event of any unforeseen incident.

2. Software and System Security

• Secure Software Usage: We exclusively use recognized, secure, and reputable accounting software (e.g., QuickBooks Online, Xero) which adhere to global data security standards.

• Regular Updates: All our operating systems, applications, and security software are updated promptly to patch vulnerabilities and maintain robust protection against emerging threats.

• Anti-Malware: All company devices are protected by enterprise-grade anti-virus and anti-malware solutions, regularly monitored for suspicious activity.

3. Personnel and Internal Controls

• Confidentiality Agreements: Every Cookstobooks team member is required to sign and strictly adhere to a comprehensive Non-Disclosure and Confidentiality Agreement (NDA) upon hiring.

• Security Training: Our staff undergoes mandatory, recurring training on best practices for data handling, phishing awareness, and compliance with data privacy regulations.

• “Need-to-Know” Principle: Access to client financial files is granted only on a “need-to-know” basis, ensuring that only the specific team members working on your account can view your data.

4. Client Communication and Document Sharing

• Secure Client Portal: We utilize a dedicated, encrypted client portal (or secure file exchange service) as the primary method for clients to upload and download sensitive documents. We strongly discourage sharing sensitive data via regular, unencrypted email.

• Identity Verification: We follow strict protocols for verifying the identity of any individual requesting access to or information about your account.

5. Incident Response

In the extremely rare event of a data breach or security incident:

• We have a detailed Incident Response Plan in place.

• We will immediately notify the affected clients and relevant authorities (if required by law).

• We will take immediate steps to contain the breach, investigate the cause, and restore full security, providing a detailed report of the actions taken.