We can go through the IT side with you. Call (604) 813-7881 and ask for Tony, or send us a note. Regular hours are Monday to Friday, 7am to 5pm MT, and a person answers emergency calls on the same number 24/7.
Client confidentiality, CRA and privacy for accounting firms
If a client file or an EFILE password goes missing, who do we call first?
Clients hand you their most private paperwork. Here is how confidentiality slips tend to happen, what public guidance asks on the IT side, and what we do.
Free consult with Tony. No pressure, no jargon.
The risk to client confidentiality
A small firm shares one login for a tax program between three people, because it was easier at the time. A laptop with last year’s returns travels between the office and a client site. A former seasonal preparer still has access to the shared drive. One day a password goes missing, or a laptop is not where it should be. The first question is not technical. It is who needs to be told, in what order, and what exactly was on it.
Good looks like one person one account, folder permissions set the same way every time, MFA on email and remote access, Huntress on every managed computer, and a written first hour plan that does not live only on the server that might be locked.
This is IT guidance in plain words, not legal advice. Rules differ by firm, so please check the current guidance and talk to your professional body or a privacy lawyer.
What we put in place on the IT side
- No shared logins. One person, one account, so you can tell who did what. Access is removed the day someone leaves.
- Client folder permissions and scan to folder. Each client folder is open only to the people who should see it, and scanners save straight into the right folder. Both are part of our standard builds.
- MFA on email and remote access. A stolen password alone is far less useful. Remote desktop is never exposed to the internet. Safe remote access.
- Huntress on every managed computer. Plus DNS filtering and a Meraki firewall. If something looks wrong, our security operations team (SOC), the people who watch for threats around the clock, sends a text alert. Disk encryption is on by default unless your software vendor says otherwise, so a lost laptop is much harder to read. Our staff have background checks and sign confidentiality agreements, because your files hold your clients’ SINs, banking details and tax records.
- Backups held in Canada. The offsite copy is held in Vancouver, BC. Server backups run on Veeam and follow the 3-2-1 rule, stay immutable for 30 days, keep an offsite copy in Vancouver, BC, and we test restores. If a server itself fails, we restore it in under 2 hours.
- Privacy reporting, in plain words. Usually provincial law applies. A private firm in Alberta or BC generally falls under its provincial PIPA, and PIPEDA can apply when personal information crosses provincial or national borders. Alberta PIPA and PIPEDA require you to report breaches that pose a real risk of significant harm. BC PIPA does not require it, though the commissioner recommends it. This is not legal advice.
- The CRA has its own MFA rules. Your CRA and EFILE credentials stay with you. We help with the IT around them. Ask us anything about how we handle your data during your free consult.
Also see
Confidentiality questions we hear
Is this legal advice?
No. It is IT guidance in plain words. Check the current rules and talk to your professional body or a privacy lawyer about what applies to your firm, including what you must report and to whom.
Do you handle CRA logins for us?
No. Your CRA and EFILE credentials stay with you. We help with the IT around them: protected computers, MFA, no shared logins and a plan for what to do if something goes missing.
Where are our backups kept?
The offsite copy is held in Canada, in Vancouver, BC. Ask us about the rest of the 3-2-1 plan for your setup.
Who at Benson Hunt can see our client files?
Our staff have background checks and sign confidentiality agreements, because your files hold your clients’ SINs, banking details and tax records. Ask us anything about how we handle your data during your free consult.