Your data, handled like it's ours to lose.
Practical controls for remote teams: least privilege, MFA, signed agreements and clean offboarding. Plus extra safeguards for financial and health data.
Least-privilege access
Assistants get only the access their tasks require, through named user accounts — never shared logins. We help you set roles during onboarding.
MFA everywhere
Multi-factor authentication on every system that supports it, following CISA guidance. Password managers for credential sharing.
Signed agreements
Every assistant signs confidentiality and data-privacy agreements aligned with the Philippine Data Privacy Act of 2012 and your requirements.
Secured devices
Updated OS, disk encryption, screen lock and endpoint protection required. Backup power and internet required.
Clean offboarding
Same-day access revocation, credential rotation and a written offboarding checklist.
Transparent about maturity
We're an early-stage company. We don't hold SOC 2 or ISO 27001 today and won't claim we do. We'll complete your security questionnaire honestly.
Extra safeguards for bookkeeping.
Money movement and bank access get the strictest controls we have.
- No stored bank credentials. Bookkeepers never hold or store your online banking logins. They work from bank feeds inside QuickBooks Online or Xero, statements you share, or their own user-level access you grant.
- Least privilege in finance tools. Named users with role-appropriate permissions in QuickBooks, Xero, Bill.com and Gusto — not admin by default.
- MFA required on accounting, payroll, AP and email systems.
- Separation of duties. Bookkeepers prepare payment runs and payroll; you approve and release payments unless you delegate limited authority in writing.
- Monthly review. A second reviewer checks every close, including unusual transactions and vendor changes.
- Vendor-change verification. Changes to vendor bank details are verified through a known contact, a common defense against payment fraud.
HIPAA-aware medical administration.
For medical administrative placements we sign a Business Associate Agreement before any access to protected health information, provide HIPAA privacy and security training, apply minimum-necessary access inside your EHR and prohibit local storage of PHI. Assistants do no clinical work. See Medical Administrative Assistants.
Frameworks we draw on: the NIST Cybersecurity Framework and NIST SP 800-63 digital identity guidelines.
Questions about security?
Book a call and bring your security questionnaire. We'll walk through every control.