Data security

Your financial records, handled the way a CPA should.

Owners send us bank statements, payroll and the numbers behind their business. Here is exactly how we receive them, where they are kept, who else handles them, and when they are deleted.

The path your records take

From the folder you upload to, through our work, to deletion.

  1. You send them privately

    How
    A private folder set up for your business alone, or access to your own accounting system.
    Never
    As an email attachment.
  2. We work on them

    Where
    A folder for your business alone, on an encrypted firm computer.
    Reviewed
    A CPA reviews every result before you receive it.
  3. We delete them on schedule

    When
    On the schedule below, or within 30 days when you ask.
    Except
    What law or professional standards require us to keep.

How we handle your records

Sent privately, not by email

You upload records to a private Google Drive folder we set up for your business alone, or give us access through your own accounting system. Please do not email Social Security numbers, full bank or card account numbers or passwords. If something we need requires them, we will give you a secure way to send it.

Kept on an encrypted computer

Our working files are kept in a folder for your business alone, on a firm computer with full-disk encryption. Your records are never mixed with another client’s.

Read-only access where possible

When you give us access to your accounting or payroll system, we ask for read-only access wherever the platform allows it, and we ask you to remove our access when our work ends. We never need your password.

Two-step sign-in

Every firm account that holds or can reach your records is protected by two-step sign-in, so a stolen password alone cannot open it.

Only the people who need it

Access to your records is limited to the people at Agility who work on your account.

Confidential under CPA rules

Robert O’Connor is a Maryland CPA. The AICPA Code of Professional Conduct requires us to keep your information confidential, and your engagement letter puts these commitments in writing. We also maintain a written information security program under the FTC Safeguards Rule, reviewed at least once a year.

Who else handles your data

A small number of service providers, each bound by confidentiality terms, each given only what its part of the work needs.

Google Workspace
Our email, and the private folders you send records through.
Microsoft
Backup of our working files, so nothing is lost if a computer fails.
Your accounting and payroll platforms
Such as QuickBooks Online, when you give us access to them.
AI-assisted analysis tools
Used to organize, classify and analyze records faster, and set so your data is not used to train AI models. A CPA reviews every result before you receive it.

What we never do

We never sell your information, publish it, or use it for anything other than the work you engaged us for.

Our sister practice

Nothing from your books is shared with AI Workforce Plus unless you ask us to, in writing.

How long we keep it

Free Benchmark Snapshot
The statement you share and our workpaper are deleted 90 days after the results meeting, unless you engage us. We keep your contact details and a short summary, as our privacy policy explains.
Client work papers and deliverables
Kept for seven years from delivery, in line with IRS record-keeping expectations, then deleted from our systems and backups.
Your source documents
Returned or destroyed when the engagement ends, unless ongoing bookkeeping needs them.
Whenever you ask
You can ask us to delete your data at any time. We delete it from active systems within 30 days, except what law or professional standards require us to keep, which stays confidential until that period ends.

If something goes wrong

We tell you

If your information in our care is ever accessed or taken without authorization, we tell you promptly, and no later than 10 days after we discover it.

We help you respond

We work with you on any notices you must give, and we make the notices that Maryland law requires of us.

Questions owners ask

Do you use AI on my financial records?

Yes. AI-assisted tools help us organize, classify and analyze records faster, which keeps our fees down. They work under confidentiality terms, they receive only what the task needs, they are set so your data is not used to train AI models, and a CPA reviews every result before you see it. Your engagement letter says this in writing.

Can I just email my statements?

Please don’t. Ordinary email is not encrypted. Use the private folder we set up for you, or give us access through your accounting system.

Do you need my bank or software password?

No. Your accounting and payroll systems let you invite us as a user or accountant with our own sign-in, read-only where the platform allows. Never send us a password.

What happens to my P&L if I don’t hire you after the Snapshot?

We remove access to the folder and delete it 90 days after the results meeting. We keep your contact details and a short summary so we can stay in touch, and we stop if you ask.

Who can I ask about my data?

Email [email protected]. You can ask what we hold, which providers we use, or for your data to be deleted.

Ask before you send anything.

If you have a question about how we handle your records, we will answer it on the first call.

Book an Appointment