How we protect your firm and your clients' data.

Contracts before files

Nothing moves until two documents are signed. A non-disclosure agreement covering everything you share with us, and a Data Processing Agreement under which your firm is the controller and Bramwell Global is the processor acting on your written instructions. The DPA contains the Article 28 processor terms UK GDPR and the EU GDPR require: confidentiality, technical and organisational measures, no sub-processing without your consent, assistance with data subject requests, breach notification and deletion or return of data at the end of the engagement.

Because our delivery centre is in Pakistan, the DPA also carries the international transfer terms your firm needs: the UK International Data Transfer Agreement or Addendum for data from UK practices, and EU Standard Contractual Clauses for data from Irish practices. If your firm has its own DPA, we will work from that instead.

Access, not copies

We work inside your software through accounts you create, over VPN, with two-factor authentication on every login. Files are not downloaded to local drives or personal devices, and nothing is forwarded to personal email. You can see every login in your software's audit log and revoke access at any time. When an engagement ends, access is removed and anything held on your instruction is returned or deleted.

US tax data and Section 7216

For US CPA firms, Internal Revenue Code Section 7216 and its regulations require the taxpayer's written consent before tax return information is disclosed to a preparer outside the United States. Your firm obtains the consent in the prescribed form and keeps it on file. We prepare only returns where that consent exists, and where your software allows, Social Security numbers are masked for our preparers. We can supply suggested consent wording for your engagement letters.

People

Every accountant and reviewer at Bramwell Global is bound by confidentiality obligations that match the NDA we sign with you. Access to your account is limited to the accountants assigned to it and their reviewer, and is removed when someone leaves the account. Staff are trained on your firm's procedures before touching your clients' records.

Review on every file

Quality is a security control. A second accountant reviews every job against a checklist for that job type before it leaves us, which is how errors, missing documents and anything unusual get caught before they reach you.

If something goes wrong

We notify you without undue delay with what happened, what data was involved and what we have done about it, so that your firm can meet its own notification duties to the ICO, the Data Protection Commission or your state board and clients. Incidents are recorded and the controls that failed are fixed.

What we do not do

• Contact your clients or use their data for anything other than the work you instruct.
• Sub-contract or share your work outside the team assigned to your account.
• Store client files outside your systems.
• Use client data for marketing, benchmarking or training materials.
• Put tracking scripts or third-party analytics on this website. There is no cookie banner because there are no tracking cookies.