# Bookkeeping Data Security: A Practice Checklist

- Author: AutoBankConvert (https://www.autobankconvert.com)
- Published: 2025-09-17
- Updated: 2025-09-17
- Category: Security and trust
- Canonical: https://www.autobankconvert.com/blog/bookkeeping-data-security-checklist

> A bookkeeping data security checklist for small practices: device rules, access per client, sharing statements safely, and what to do after a breach.
Bookkeeping data security means keeping client statements, ledgers and logins out of the wrong hands across your devices, accounts, shared files and staff changes. A small practice needs a short written set of rules for each of those four areas, plus a plan for the day something goes wrong.

## What does bookkeeping data security cover in a small practice?

In a small practice, bookkeeping data security covers every place client financial data sits or moves: laptops and phones, email and cloud storage, accounting software, conversion tools, and the people who can sign in to any of them. The goal is to know where the data is and who can reach it.

### Four areas to protect

A useful way to think about it is four groups, which the checklist later in this post follows:

- **Devices**: the laptops, phones and external drives that hold or open client files.
- **Accounts**: the logins to email, accounting software, cloud drives and statement tools.
- **Sharing**: how files travel to clients, CPAs and staff.
- **Incidents**: what you do when a device is lost or an account is taken over.

A practice of one person has the same four areas as a practice of ten. Only the number of logins changes.

### What counts as client data

Client data is wider than the statement PDFs. It includes exported spreadsheets, QuickBooks or Xero logins, payroll details, tax IDs in onboarding forms, scanned receipts, and the email threads where clients explain their finances. A phone photo of a statement counts. So does the Downloads folder.

### Why small practices are exposed

A large firm has an IT department. A small practice usually has a laptop, a cloud drive and good intentions. The risk comes from habits, not from skilled attackers: a shared password, a laptop with no screen lock, a file sent to the wrong client. These are cheap to fix. The sections below turn each one into a rule you can write down once and follow.

Write the rules on one page and keep that page where staff can find it. A rule that nobody can look up is a rule nobody follows.

## Device and password rules for bookkeeping staff

Device and password rules say how every laptop, phone and login that touches client data must be set up. Keep them short enough that staff follow them: lock screens, full disk encryption, a password manager, and a second sign-in step on every account that supports one.

### Devices

1. **Lock every screen automatically.** Set a short timeout and require a password or biometric to wake the device.
2. **Turn on full disk encryption.** Modern laptops and phones offer this in settings. With it on, a lost laptop does not expose its files.
3. **Install updates.** Operating system and browser updates fix known holes. Turn on automatic updates.
4. **Keep client files off personal devices** unless the device follows the same rules.
5. **Do not leave statements in Downloads.** Move files to the client's folder and clear the folder weekly.
6. **Wipe or hand back devices when someone leaves**, and remove their accounts from the device first.

### Passwords and sign-in

A password manager lets each person use a long, unique password for every service without remembering them. Shared passwords are the habit to break first: when two people share a login, you cannot tell who did what, and removing one person means changing the password for everyone.

Turn on two-step sign-in (a code or approval from a second device) for email, the cloud drive, the accounting software and any statement tool. Email matters most, because anyone who controls your email can reset the other passwords.

### Public networks and home offices

Work from a public network only over connections that use HTTPS, and avoid opening client files on a shared or borrowed computer. In a home office, keep work on a separate user account from the family computer, and use a screen lock so a visitor or child cannot open a client's books.

Paper counts too. If a client mails you printed statements, scan them, file the scan, and shred the paper once the client has confirmed you hold a good copy.

## Per client access to bookkeeping data

Per client access means each person on your team can open only the clients they work on, and each client's files, rules and history stay separate. This limits the damage from one mistaken click or one stolen login, and it makes it easy to remove a person from a single client.

### Give people the least they need

A new hire does not need all forty clients on day one. Start them with their assigned clients and add more as their work grows. When a client leaves, remove everyone's access to that client in one step, instead of hunting through folders.

For software, look for workspaces that separate clients. AutoBankConvert keeps each client's accounts, rules and history in their own workspace, so nothing crosses between books, and its Firm plan adds team seats and roles. If you are unsure how to split duties between preparers and reviewers, the post on [team permissions that match each role](/blog/bookkeeping-team-roles#team-permissions-that-match-each-role) walks through it.

### Keep a client access list

A simple table is enough. It tells you, at a glance, who can open what:

| Client | Who has access | Where files live | Last reviewed |
| --- | --- | --- | --- |
| Example Bakery LLC | Owner, Staff A | Client folder, accounting file | Example date |
| Example Dental Group | Owner, Staff A, Staff B | Client folder, accounting file | Example date |

The values are examples. Review the list every quarter and each time someone joins, changes role or leaves.

### Clients' own access

Clients should not share their bank or accounting logins with you if there is an alternative. Most accounting software lets you invite a bookkeeper as a separate user with a role, which keeps the client's own login private and lets them remove you later. Where you must use a client's credentials, write that down in the engagement letter, store the credentials in the password manager, and stop using them when the work ends.

### Sharing statements safely

Send statements and exports to clients and CPAs through a link to a named person, not an attachment to a long email chain. Set links to expire where the service allows it. Avoid "anyone with the link" sharing. The confidentiality rules for CPAs are in the post on [client confidentiality in bookkeeping](/blog/client-confidentiality-in-bookkeeping).

## What should a practice do after a data security incident?

After a data security incident, act in this order: stop the exposure, find out what was affected, tell the people who need to know, then fix the cause. Do not delete evidence while you stop things. Write down what you did and when as you go.

### The first hour

1. **Contain it.** Change the password of any affected account, sign out all sessions, and disconnect a lost or compromised device from your accounts.
2. **Switch on or reset second-step sign-in** for the account.
3. **Preserve what you have.** Keep emails and screenshots of what happened.
4. **List what was exposed.** Which clients, which files, which dates?

### The next days

Tell the affected clients promptly and plainly: what happened, which of their files were involved, and what you have done. Check your engagement letter, your professional body's rules and any law that applies to your clients and region, because notification duties vary and some can have short deadlines. Ask a lawyer or your insurer if the exposure is large or involves tax IDs or account numbers.

If a vendor is involved, ask for their account of the event in writing. A good vendor has a published contact for reports. AutoBankConvert lists a link to report a security issue in the site footer.

### Afterward

Write a short note on the cause and the change that prevents a repeat. Add that change to the checklist. An incident that leads to one new rule has at least done some good. One cause to rule out: a statement your tooling could not read, pasted into an unknown service to get it converted. See [why some statements are flagged instead of converted](/blog/unsupported-bank-statement-flagged) for safe ways to fix the file itself.

## Security gaps from former staff accounts

Former staff accounts are a quiet gap: the person has left, but their login, their device and the shared passwords they knew still work. Remove access on the day someone leaves, in a fixed order, and check afterward that nothing still works.

### Offboarding steps

1. Disable their email and cloud drive accounts, or move them to a locked state.
2. Remove them from the accounting software, statement tools and every client's workspace.
3. Change every shared password they knew. This is the strongest reason to avoid shared passwords.
4. Recover or wipe their devices, and delete client files from any personal device they used.
5. Revoke any links they created to client folders.
6. Update your client access list, and note the date.

### Contractors and temporary help

A seasonal contractor is staff for security purposes. Give them accounts that expire on a set date, and treat the end date as the offboarding day. The same applies to a family member who helped during a busy month.

### The practice security checklist

Use the checklist below as a monthly review. Each group matches an area from the start of this post.

**Devices**
- [ ] Screens lock automatically on every device
- [ ] Disk encryption is on
- [ ] Updates are current
- [ ] Downloads folders are clear of client statements

**Accounts**
- [ ] Every person uses a password manager
- [ ] Two-step sign-in is on for email, drive and accounting software
- [ ] No shared logins
- [ ] Client access list reviewed this quarter

**Sharing**
- [ ] Files go by named link, not open link
- [ ] Old links are revoked
- [ ] Statements are not left in email threads
- [ ] CPAs receive files through a secure share

**Incidents**
- [ ] A written first-hour plan exists
- [ ] Client notification wording is drafted
- [ ] Vendor security contacts are saved
- [ ] Former staff access was removed on the leaving date

If you convert statements in bulk, put the conversion tool on this list too. [AutoBankConvert](/) keeps each client in a separate workspace and encrypts files in transit and at rest, which covers part of the "accounts" and "sharing" groups. The rest is still your practice's routine.