What actually protects your data.
Every control below is enforced in the application today, not a roadmap item or a marketing claim. Where something isn't built yet, it isn't listed here.
Data privacy & tenant isolation
Every client record, workfile and document belongs to exactly one firm. Every query in the application is scoped to the signed-in user's own firm — a firm on this platform can never read another firm's clients, staff, leads or documents. Nothing here is a claim of certification; it is how the data model itself is built.
Encryption
Passwords are hashed, never stored in plain text. Sensitive credentials a firm stores against a client — an IRD or OCR login used to file on the client's behalf, a payment-gateway secret, an SMTP password — are encrypted at rest with a key held outside the database, and are never echoed back to the browser except through one explicit, audit-logged "reveal" action.
Access control
Every staff account is scoped to what it's actually been granted, module by module, with an optional expiry date. A firm's own admin can grant only what the firm itself is entitled to under its plan — access control is enforced twice: once at the individual grant, once again at the firm's own ceiling.
Audit logs
Every create, update and delete of consequence is written to an append-only audit trail — who, what, and when. Reviewers and admins can see what changed on a record without having to trust an unlogged claim.
Versioning & autosave
Working files save automatically and carry a version number. Two people editing the same file are shown a conflict rather than having one silently overwrite the other. A snapshot history exists for recovery, with a configurable retention period.
Backups
The database is backed up on a schedule, with older backups pruned automatically after a configurable retention window — a deliberate, working process, not a manual afterthought.
AI governance
The copilot detects, explains and shows its evidence — it never files, finalizes or submits anything on its own. Every suggestion reaches the professional as a proposal with a stated reason and a source reference, to accept, modify, reject or investigate further. See the Platform page for the full DETECT / EXPLAIN / EVIDENCE / DEFER model.
Professional responsibility
CA Automator is infrastructure for the work around a professional opinion — it is not itself the professional opinion. Every computation, flag and draft is a proposal for a Chartered Accountant to review, challenge, modify and sign off. Statutory responsibility for the final report or filing sits with the professional, not with the software.
Data residency & regulatory disclaimers
This page describes controls that exist in the application today. It is not a claim of ISO, SOC 2 or any other third-party certification unless the firm using this platform states one separately, and it is not a substitute for that firm's own regulatory and data-residency obligations in the jurisdictions it operates in.