Security·And your data

You are handing a finance function the keys to the business. Here is how they are held.

We looked at more than forty firms selling fractional finance leadership before writing this page. Not one of them says anything, anywhere, about how client financial data is protected — for a role that is handed the general ledger and the bank logins on day one. This page is the answer to the question they leave you to ask in a sales call, and every commitment on it is a term of the agreement rather than a statement of intent.

BOOK A CONVERSATIONSEE THE COMMITMENTS
WHO CAN SEE YOUR NUMBERSThe named people on your account, and any specialist your CFO brings in for a defined piece of work
WHERE YOUR DATA LIVESIn your own systems. We are users inside them rather than a separate copy of your business
WHO HOLDS PAYMENT AUTHORITYYou do. We design the controls and stay outside them
WHEN CONFIDENTIALITY STARTSThe first conversation, before anything is signed
WHO OWNS WHAT WE BUILDYou, from the day it is built, in editable format
WHAT HAPPENS ON THE LAST DAYAccess withdrawn and confirmed back to you as a written list
How Access Works
01 / 02

Six commitments, in the order they matter to you.

These are written into clause 1.6 of the engagement agreement, which is published in full on the Engagement page. Nothing here depends on you asking for it.

01Access is granted by role, and only what the role needsNobody on your account holds a credential their work does not require. Your CFO, your controller and your named backup have what the seat needs; a specialist brought in for a fortnight gets only what that piece of work touches, for only as long as it takes. Access is requested, approved and recorded rather than shared.
02We work in your systems, under your own controlsYour accounting platform, your bank portal, your document store. We are named users inside them, which means your own audit trail shows exactly who did what and when, and you can see and revoke any of it without asking us.
03We build the payment controls without sitting inside themWe design how money moves and who approves it. Signing authority and payment release stay with your people. That separation is the only thing that makes a payment control worth having, and it protects you from us as much as from anyone else.
04Confidentiality applies from the first conversationNot on request and not once something is signed. The first call is covered, the diagnostic is covered, and the assessment we hand you at week three is yours alone. Several of the engagements on our results page are anonymized precisely because a firm that publishes those names is a firm you would not want holding yours.
05Everything built on your account belongs to you as it is builtModels, documentation, close calendars, control matrices, systems configuration and reporting templates — in native editable format, from the day of creation, not on exit and not on request. There is no locked file and no version of your finance function that only we can open.
06Access ends on the last day, and we confirm it in writingEvery system, every portal, every credential, withdrawn and then listed back to you so you can check it against your own records rather than take our word for it.
Independence
02 / 02

And one more thing worth knowing about whose interests we hold.

Security is usually discussed as a technical question. The larger risk in this category is commercial: a finance adviser who earns something on the side from the lender, the broker or the software they recommend to you. Clause 1.5 rules it out.

1.5Independence

The firm accepts no referral fee, commission or revenue share from any software vendor, lender, broker or adviser it recommends to a client.

WHAT THAT MEANS FOR YOU

Our only revenue is your fee. When we put a lender, a system or an adviser in front of you, there is nothing in it for us, which is the only condition under which a recommendation is worth having. Of the firms we surveyed, one mentions this at all, in passing. It is a clause here.

What happens next

Ask every firm on your list the same questions. Ours are already answered.

Who can see the numbers, who holds payment authority, when confidentiality starts, who owns the models, and what happens to access on the last day. Five questions, and the answers should be in writing before you hand anyone a bank login.

THE ACCESSGranted by role, recorded, and revocable by you without asking us.
THE SEPARATIONWe build the payment controls and stay outside them.
THE OWNERSHIPEverything built for you is yours from the day it is built, in editable format.
THE EXITAccess withdrawn on the last day and confirmed back to you as a written list.
BOOK A CONVERSATIONREAD THE AGREEMENT
ONE HOUR · NO CHARGE · A WRITTEN NOTE BACK WITHIN TWO WORKING DAYS