Security & hosting
The questions to ask anyone who will hold your books
Accounting data is the last thing a business can afford to lose and the first thing it cannot re-create. These are the questions worth asking any vendor, including us. Bring them to the call and make us answer them out loud.
Ten questions
What to ask, and why each one matters
They are in the order we would ask them. A vendor who answers the first three specifically and the rest vaguely is telling you something.
Where does the data physically sit?
A country, a provider and a region, not "the cloud". It determines which laws apply to your books and who can compel access to them.
How often is it backed up, and how far back can it be restored?
Frequency and retention are different questions, and so is whether a restore can land on a point in time rather than on last night.
Has a restore actually been tested?
A backup nobody has restored from is a belief, not a backup. Ask when the last test was and what it took.
Is it encrypted in transit and at rest?
Both, separately. In transit is table stakes; at rest is the one that matters if a disk or a snapshot leaves the building.
Who on the vendor side can see my data, and under what circumstances?
Support work sometimes needs access. What you want is a policy about when, and a record of each time it happened.
What is the uptime target, and how is it measured?
A number with no measurement method behind it is a slogan. Ask what counts as downtime and who decides.
Can I export everything, in a format I can open elsewhere?
The whole ledger, not a report. This is the question that decides whether you are a customer or a hostage.
What happens if the vendor stops trading?
Escrow, an export you already hold, a handover commitment: something. Ask a small vendor this directly; a good one will have thought about it.
Who else touches the data?
Hosting, email, payments, messaging. Each sub-processor is a company you are also trusting, so the list should exist and be readable.
If there is a breach, when and how do I hear about it?
Before your customers do, in writing, with what was affected. Agree it before it is needed rather than during.
Ask us
Ask us all ten
Put them to us on the call, in this order. Where we can answer specifically we will, and where we cannot yet we will say that rather than talk around it, which is the same thing we would want you to demand of any other vendor.