Client-controlled systems
Work is performed in cloud applications you approve, or through your VPN. Access is provided through named identities.
Security and confidentiality
Security and confidentiality for offshore finance teams.
Security is designed with each client around its data, systems and risk settings. We explain what we control, what you control and what has to be agreed together.
Connected controls
Client environment Identity Device Access Review
Control model
Keep information in the environment you govern.
Authentication and access
MFA, least privilege, role changes and offboarding are set around your identity and security policies.
People and process
Confidentiality expectations, escalation, review and incident reporting are established through employment and engagement processes.
Shared responsibility
Controls only work when ownership is named.
The client owns its information classification, accounts, devices, permissions, technical logging, backup and approval design. We manage the Philippine employment relationship and apply the employment, confidentiality and operating requirements agreed for the role.
Agree before onboarding
- Permitted systems, locations and data handling
- Device ownership, support and patching
- MFA, VPN and privileged-access rules
- Incident contacts and notification pathway
- Access removal and return of client property
- Business continuity priorities and recovery steps
Cross-border privacy
Australian and Philippine obligations need to be considered together.
Australian organisations should assess whether APP 8 and other privacy duties apply to overseas disclosure. Accounting and tax practices should also consider Tax Practitioners Board guidance on outsourcing, confidentiality, supervision and competent service.
Jade operates as a Philippine company and is subject to applicable Philippine privacy requirements. The exact controller, processor and disclosure roles depend on the engagement and must be documented; this page is operational information, not legal advice.
No absolute claims
Due diligence should test the real arrangement.
No supplier can promise zero risk. Ask how identities, devices, access, supervision, incident response, continuity and offboarding will work for your specific data and role.
Use the due-diligence checklist →Due diligence
Questions worth asking any offshore provider, including us.
Security answers are only useful when they are specific to your data and your systems. These are the questions that separate a real arrangement from a reassuring one.
| Area | Ask | A weak answer sounds like |
|---|---|---|
| Data location | Where will our data physically be, and what can be stored locally on a device? | “Everything is secure in the cloud.” |
| Identity | Will each person have a named account in our systems, with MFA? | “We use a shared login for the team.” |
| Devices | Who owns, patches and configures the device, and what happens if it is lost? | “Our staff use their own laptops.” |
| Access changes | How quickly is access removed when someone changes role or leaves? | “We would let you know.” |
| Incidents | Who do we call, within what timeframe, and what is documented? | “We have never had an incident.” |
| Continuity | What happens during a typhoon, an outage or an extended absence? | “We guarantee uninterrupted service.” |
| Certification | What is independently certified, and what is simply practice? | Naming a standard without a current certificate. |
We do not hold a formal certified information-security or business-continuity certification, and we would rather say so than imply one. What we can describe precisely is how access, devices, supervision and offboarding are arranged for your engagement.
Offboarding
The part most providers skip.
Access is easy to grant and easy to forget. Whether an engagement ends, a person changes role or the scope narrows, the removal path should be written down before the first account is created.
That means knowing which systems the person can reach, who is responsible for disabling each one and within what timeframe, what happens to any client material held locally, and how the removal is evidenced. We apply the employment-side controls; your business owns the accounts, so the technical removal is yours to perform. Agreeing that split at the start avoids the common situation where an offshore account stays live for months after it should have closed.
The full due-diligence checklistRemoval checklist
- Named list of every system and account granted
- Owner and timeframe for disabling each one
- Return or destruction of client material
- Device return, wipe or reassignment
- Written confirmation that removal is complete
Questions and answers
Practical details
Where is client data stored?
The operating model is designed for work in client-controlled cloud systems or through client-approved VPN access. Local storage and transfer rules must be agreed for each engagement; we do not make a universal data-residency guarantee.
Who provides devices and security software?
You provide or specify devices, software, licences, identities and security requirements. The final arrangement is documented before onboarding.
Do you guarantee uninterrupted service?
No. Business continuity arrangements are agreed with each client based on roles, location, systems and recovery needs. No control eliminates all incidents or disruption.
Do you hold ISO 27001 or a similar certification?
No. We do not hold a formal certified information-security management system, and we will not imply otherwise. Security is arranged around your controls, your systems and your risk settings, and documented for the engagement.
Can our security team review the arrangement before we start?
Yes, and we would encourage it. The access model, device standard, identity arrangements and incident path are agreed before onboarding rather than settled afterwards.
Next step
Bring your security requirements into the role brief.
We will map the proposed access, device and operating controls with your team before onboarding.