Ledger Brigade is ISO 27001-aligned, not ISO 27001 certified. Our policies and controls follow the standard's framework and are reviewed internally every year.
Your data stays in your systems
We work inside your own accounting software as a named, invited user: QuickBooks, Xero and Zoho Books through their built-in user access, and Tally Prime through TallyPrime Server or cloud access with our own login. Your books never move to our servers. You control who has access, and you can remove our access at any time.
How we protect your information
Access control
Every team member has a named login. No shared passwords. Access is limited to the clients and tasks each person works on, reviewed every quarter, and removed within 24 hours when someone leaves or changes role.
Secure sign-in
Multi-factor authentication is required on email, accounting software and every system that holds client information. Passwords are stored in a company password manager.
Encrypted storage and audit trails
Client documents are kept in encrypted, access-controlled storage. Activity in our systems and in your accounting software is logged, so there is a record of who accessed what, and when.
Protected devices
Work laptops use full disk encryption, automatic screen lock, up-to-date operating systems and active anti-malware protection. Removable storage is not used for client data.
Trusted people
Every team member is background checked and signs a confidentiality agreement before working on client files. The team completes security awareness training every year.
Secure communication
Our email domain is protected with SPF, DKIM and DMARC, so emails pretending to come from us are flagged and sent to spam. Documents are shared through access-controlled links, not as open attachments.
Incident response
We have a written incident response plan. If a security incident affects your data, we will notify you promptly and report to the relevant authorities as required by law.
End of engagement
When an engagement ends, we remove our access to your systems and delete your files from our working storage.
How our controls map to ISO 27001
| Control area | What we do | ISO/IEC 27001:2022 Annex A |
|---|---|---|
| Information security policy | Written policy approved by the partners and reviewed every year | A.5.1 |
| Acceptable use | Rules on how staff use company systems and client information | A.5.10 |
| Access control | Named logins, least privilege, quarterly access review, removal within 24 hours | A.5.15, A.5.18 |
| Authentication | Multi-factor authentication and a password manager | A.5.17, A.8.5 |
| Screening | Background checks before joining | A.6.1 |
| Confidentiality | Signed confidentiality agreements and NDAs | A.6.6 |
| Awareness and training | Annual security awareness training | A.6.3 |
| Endpoint devices | Encryption, screen lock, no removable storage | A.8.1 |
| Encryption | Encrypted laptops and encrypted document storage | A.8.24 |
| Logging | Activity logs in our systems and in client accounting software | A.8.15 |
| Malware and updates | Active anti-malware and automatic updates | A.8.7, A.8.8 |
| Secure communication | SPF, DKIM and DMARC on our email domain; access-controlled file sharing | A.5.14 |
| Data deletion | Client files deleted from our working storage when an engagement ends | A.8.10 |
| Incident management | Written incident response plan with client notification | A.5.24, A.5.26 |
Security reviews and questionnaires
We can share summaries of our security policies, and we will complete your security questionnaire (such as SIG Lite or CAIQ) on request, under NDA. Book a Briefing or email hello@ledgerbrigade.com to request them.