Security and GDPR
Your clients trust you with their affairs. We've built QuickManager so that trust travels with the data.
Accountancy data is both personal and financial. These are the controls that keep it private, separated and under your practice's control, written for people, not auditors. Technical detail is available on request.
How it's protected
Six layers, from the database up.
01
Separation enforced by the database
Every record carries its practice. The database itself refuses to return a row to anyone outside that practice, whatever the application asks for. Over 150 automated checks run against these rules on every change to the code.
02
Least privilege for every role
Staff see their own timesheets; practice admins see the practice's. Only admins can invite people, change targets or reveal sensitive fields. QuickManager's own website administrators can manage a practice's settings but cannot read its clients, tasks, notes or documents.
03
Encryption of the fields that matter most
National Insurance numbers and supplier passwords are encrypted with AES-256 before they are stored, bound to the exact client and field they belong to. The key never leaves the server. Only practice admins can reveal a value, and every reveal is recorded with who, what and when.
04
Private document storage
Files live in a private store organised per practice. Downloads use short-lived links that expire within a minute, and the database checks the practice before any link is created.
05
No client data in logs
Server logs hold error codes only: never names, emails, references or message content. Reminder emails record the date, sender and reason, not the email. Assistant conversations are not stored at all.
06
A record of administrative change
Every change a website administrator makes to a practice (plan, sections, status) is written to an append-only log that the practice can ask to see.
The facts
What a data protection officer will ask.
Data location
Ireland (EU), with the application servers in Dublin alongside the database. Recognised as adequate under UK GDPR.
Encryption in transit
TLS on every connection, between your browser and QuickManager and between QuickManager and its providers.
Encryption at rest
Disk-level encryption for the whole database and file store, plus field-level AES-256-GCM for NI numbers and passwords.
Authentication
Email invitations with single-use links, minimum eight-character passwords, no public sign-up. Practices control who is invited.
Sub-processors
Supabase (database, sign-in, files), Vercel (hosting), Resend (email) and, only if a practice switches the assistant on, Anthropic.
Your rights as controller
A data processing agreement for every practice, help with subject access requests, breach notification without undue delay, and deletion or return of data when you leave.
The assistant
AI, with a short leash.
The assistant is off until a practice asks for it. When it's on, it works the way a careful new starter would: it can look things up, it can't change anything, and it never sees the most sensitive fields.
- Reads only. It cannot add, edit or delete records.
- Never receives NI numbers, dates of birth, UTRs or other tax references, addresses, phone numbers, client notes, logins or documents.
- Runs as the signed-in person, so it sees exactly what they can see and nothing more.
- Conversations are not stored. Only question and token counts are kept, per person per day.
- Limited to 40 questions per person per day, and switched on per practice by QuickManager.
Questions about security?
We're happy to walk your DPO or IT lead through any of this.