How we protect your data and your clients’ data.
The controls and agreements behind every engagement, ready for your compliance review.
Your clients’ data stays in systems you control.
-
Agreements first
An NDA with you, and confidentiality agreements with every team member.
-
Access you grant
Role-based access in your own software, with multi-factor sign-in.
-
Controlled devices
Work happens on company-managed laptops with full-disk encryption, USB storage and printing disabled.
Agreements
- An NDA with you before any data is shared.
- Confidentiality clauses in every employment contract.
- A data processing agreement, available on request.
Access
- Least-privilege access: each person sees only what their role needs.
- Credentials you provision and control, in your own systems.
- Multi-factor authentication on every system.
- Access removed within 24 hours when someone leaves or the engagement ends.
People
- Security and confidentiality training at joining and every year after.
Devices and workspace
- Work is done on company-managed laptops with full-disk encryption, USB storage and printing disabled.
- The team works from an access-controlled office with a clean-desk policy and CCTV.
- Client data is never stored on personal devices or local drives.
Incident response
- Notice within 24 hours of any incident affecting your data.
- What happened, what data was involved, and what we’re doing about it.
Our standard confidentiality statement
The wording we put in proposals and engagement letters.
Every LedgerShore team member signs a confidentiality agreement and completes security training at joining and every year after. We work through accounts you provision, protected by multi-factor authentication, on company-managed laptops with full-disk encryption, USB storage and printing disabled. Client data is not stored on personal devices.
We only publish controls we operate today. Ask for our security overview and we’ll walk your team through it.
Security questions
Where is our data stored?
In your systems. We work inside software you provision, so your data stays where you already keep it. We don’t copy client files into our own storage.
Can you complete our vendor security questionnaire?
Yes. Send it with your inquiry or after the NDA is signed, and we’ll return it with supporting evidence.
Can we audit your controls?
Yes. We can walk your IT or compliance team through our controls on a call, and share our security overview and policies under NDA.
What happens to access when an engagement ends?
All access is removed within 24 hours, and we confirm it to you in writing.