Backups and an archive of the books
Daily backups plus a separate archive of closed years, because the retention duty reaches further back than the oldest copy in an ordinary backup system. We test restoring rather than assume it will work.
When a server fails at an ordinary company, that company has a bad day. When it fails at your office on the twentieth, a hundred of your clients have a bad day, and the conversation about who pays their interest happens in your yard. That difference changes almost everything in IT: what has to be duplicated, who may see what, and when anything may be updated.
We are not the maker of your accounting software and we do not advise on tax. We handle the layer underneath: the server the software runs on, backups of the books, accounts, permissions and making sure everything works on the twentieth. When the problem is in the application itself we talk to its vendor on your behalf rather than sending you to a helpline.
This is not the same subject as connecting your own software to the system. An office acts on behalf of other people's taxpayers, so the problem is not the integration but the fact that there are as many permissions as clients, and each is granted by someone else.
To work on a client's invoices the office has to be authorised separately for that client's tax number. With a hundred clients that is a hundred configurations, not one setting. The client grants the permission, so part of the work is walking them through it before the month starts.
The system tells these permissions apart and most offices need only the first, meaning downloading sales and purchase invoices to post them. It is worth taking the narrower scope, because fewer permissions mean fewer questions in a dispute. An office with the right to delegate can then assign its own staff.
A client that is not a natural person and has no qualified electronic seal must use the ZAW-FA notice to designate a natural person acting on its behalf. Only that person can then grant permissions electronically. This is where the process most often stalls, because the form needs signatures from those representing the company.
One date to watch: the token as a means of authentication works until 31 December 2026, after which the system certificate takes over, valid for at most two years and renewable. That has to be changed over in good time, not in December. A rule not to be bent: certificates and tokens are not shared between people, everyone authenticates with their own. Whether the software itself supports the current invoice structure we check under system rollouts.
Towards its clients' data an office is a processor, not a controller. That reverses the situation: not only do you answer for security, your client may also come and ask for evidence that you provide it.
Every client should have a data processing agreement in place, and with it a right to audit. In practice it comes down to a few questions about who has access to their documents, where the backups sit and what happens when the relationship ends. The answers have to be ready, not invented on the phone.
The most common finding in a review is not a break-in but that every bookkeeper can see every client, including the ones they do not handle. We set permissions at the level of folders and software modules rather than trust in the team, because the latter is not evidence.
When a client leaves you have to hand their data over and know what stays with you and for how long. Some records you must keep under your own obligations, some should be deleted. Without a set procedure this ends as a copy of the whole disk on a memory stick and complaints a year later.
Honestly: part of this is documents and contract clauses, which is work for a lawyer rather than an engineer. We answer for the technical side and for making sure the answers to a client's questions can be backed by a screen from the system rather than a declaration. We record the starting point in an IT audit. We hold no ISO 27001 certificate and never claim one.
In this industry the calendar is harder than anywhere else, and the effects of a delay do not stop at your own firm. That is why the conversation about backups and spare hardware looks different here than in an ordinary office.
From the start of the month until the twenty-fifth the server with the accounting software is untouchable, and that is how we write it into the contract. Updates, moves and anything that might go wrong belong to the second half of the month, agreed in advance.
The policy required by the accounting act covers keeping books, with a minimum sum equal to ten thousand euro per event. Outside it sit tax settlements, payroll, personnel records and social insurance, which is precisely where most claims arise. Worth checking with a broker, as we do not sell insurance.
Since the deadline cannot move, what counts is how quickly the team gets back to work, not how quickly we repair the server. So we talk about working from a backup copy, about a second internet link, and about a bookkeeper being able to work from home the same day if needed.
We do not promise restoration in fifteen minutes or a hundred per cent availability, because such figures cannot be kept with a single server in an office. Instead we establish how many hours of downtime you can bear at the peak of the month and pick the solution to fit that number. How to work it out is covered under backups.
Six areas we usually start from. Under each one is a link to the page with the detail.
Daily backups plus a separate archive of closed years, because the retention duty reaches further back than the oldest copy in an ordinary backup system. We test restoring rather than assume it will work.
An accounting office mailbox is a tempting target, because invoices and bank account numbers pass through it. A second factor on a hardware key closes the most common way in.
A record of access to client documents and oversight of privileged accounts, including those used by an outside firm. This is the evidence for a client review.
So that an invoice does not circle by email between the bookkeeper and the client's board. A simple flow with approval and history, built on tools you already have in your office suite.
Copying data between systems can be automated so that client documents never pass through somebody else's service. The tool then runs on your own hardware.
Settling what to move and what to keep in house, together with the cost calculation and an answer to where client data physically sits.
What it does not cover: the accounting software itself, its substantive updates and tax advice. Nor do we scan documents for you. We do help choose a scanner and set it up so files land straight in the right client folder rather than in one shared directory.
We schedule the first visit after the twenty-fifth, because before that nobody has the headspace to discuss infrastructure. A small thing, but it shows whether a supplier understands this industry.
We ask about the number of clients, the accounting software, how documents arrive and what happens when the server stops at the peak. We come back with a list of risks and an order of work. Free, and the list stays with you whatever you decide.
First we check whether anything can actually be restored from the existing copies, because that is the most common surprise. Only then do we discuss anything else, because without a working backup the rest is a conversation about decor.
We separate access to individual clients' data, switch on a second sign-in factor and record who can reach what. The result is a set of answers that come in useful at the next client review.
Requests, updates only in the second half of the month, restore tests and a report. During the filing peak we stay on standby and plan no changes of our own.
Pages that come up in conversations with accounting offices.
Pick your industry and see how comprehensive IT support and IT outsourcing for SMEs can help your company.
No, authorisation happens separately in the context of each client's tax number, so there are as many configurations as clients. What can be automated is the connection on the software side, along with putting the order in place so it is not all done in the last week. The client grants the permission, so the plan has to include them too.
It should not be done. A certificate issued to a named person serves that person and is not shared with others. The correct route is for the client to grant the office a permission in the system, with the office authenticating by its own means. It is also easier when parting ways, because the permission is withdrawn in one move.
Yes, with the technical part: who has access to their data, how backups work, when we last tested a restore and what sign-in looks like. We also supply evidence to attach. We do not draft the agreement itself, as that is a lawyer's work, and we say plainly when the answer is no.
No, and it is one of the first things we tidy up. We set access to the clients a given person actually handles, at the level of folders and software modules. In a review the argument that you trust your people is not an answer, whereas separated permissions are.
After the twenty-fifth and never earlier, unless it is patching a hole already being exploited, in which case we call and agree it case by case. The clause making the server untouchable in the first half of the month goes into the contract so it does not depend on one technician remembering.
It depends on whether your software maker offers a cloud version, because with many trade-specific programs that settles it. If they do, weigh the subscription against the cost of a server and replacing it every five years. If they do not, a common answer is to keep the program in house and publish it for remote access.
That is a question for a lawyer, because the periods differ for books, tax records and personnel files, and some duties stay with the client rather than with you. What matters technically is something else: being able to separate one client's data and delete it without touching the rest. That has to be prepared for in advance.
We price from the number of workstations and the scope, and accounting offices usually fit the standard retainer, because there are as many computers as people. We price separately the server with the accounting software, if it is to be under ongoing care, and on-call cover for peak days if you need it.
The first meeting takes 30 minutes and commits you to nothing. We will tell you straight whether we can help and what we would propose.
2019 - 2024 Interactive Workspace Ltd. - All rights reserved.