At Lucent Advisory we take data security, and the protection of your data, very seriously.
We recognise that the sharing of data can be problematic for Accounting, Payroll and HR firms. We have never experienced any issues, but are aware of serious security breaches caused by a lack of discipline from accounting firms.
This is why we have implemented several multilayered secure systems to protect your data.
Practice Protect
Practice Protect is security software built for accounting firms to help manage the flow and storage of data securely. You can read more about it at www.practiceprotect.com.
Some of the features of Practice Protect that will give you greater peace of mind include:
- 2048-bit encryption – many times that of a standard password manager
- Password cloaking – our team will never see your user login details
- Timed, IP, and geo-specific access locks for our team
- Randomly generated mass password resets
- Total monitoring to ensure that your data is only accessed when provisioned
- One click user lockouts
- Compliance documents and regular team training
Karbon
Our practice management system, called Karbon, uses Microsoft SharePoint as an integrated document-sharing solution.
For security and compliance, Karbon follows robust GDPR measures, including data encryption, access control, regular audits, and automated data backups. These safeguards ensure that user data is protected, and that the platform adheres to international data protection standards.
Karbon stores its data on the Microsoft Azure in Australia, specifically in the Australia East (au2) region. The uptime service level agreement (SLA), we maintain a 99+% availability for our services. All information stored within the Karbon platform, including Client Request data, is encrypted in transit and at-rest using enterprise-grade highly scalable cloud servers and databases in accordance with GDPR and other privacy standards. The platform undergoes regular security audits, including SOC 2 Type 2 examinations, to maintain high security standards.
If a Lucent client requires access to all open and completed requests (including comments and documents), they can log in to the Karbon Client Portal, which is a password-protected web application that is more secure than email.
All client request messages are configured with transport layer security (TLS) encryption protocol (an advanced form of secure socket layer – SSL encryption) to encrypt client request messages, submitted client documentation or artifacts during data transmission activities over the internet.
This encryption transfers all messages and artifacts within the Client Portal over the internet in ciphertext, reducing the likelihood of data being compromised during our client’s use of the Client Portal. Encrypting the Client Portal with TLS means that our client’s use of the Client Portal is secure, and data is encrypted and shared safely.
The Client Portal requires that our clients submit a username and password prior to gaining access to the portal. Submission of a username and password requires that the Client Portal validates the identity of the user prior to gaining access to all the client requests sent to the client.
Only Lucent clients can access our Client Portal. To access the Lucent Karbon portal, the email address needs to be associated with a contact in our Karbon account. Once logged in, the client will only see the client requests sent to the email address they logged in with.
‘Magic Links’ provide a convenient and secure method for a party to verify their Identity. When a client receives a Client Request from Karbon, it will include a unique Magic Link to access the request from the body of the email.
Magic Links can only be used once by a single device. Once it has been used, the device that received the email is considered a trusted device. Any attempt to reuse the link on any other device will be declined.
Magic Links expire after 30 days. Regardless of whether a link has been activated or not, its access to the portal will expire after 30 days of being generated and are only valid for the lifetime of the work item.
All data is hosted on Servers in Sydney Australia.
Employment Hero
Employment Hero, our HR and payroll platform, stores data using AWS (Amazon Web Services) technology, ensuring high security and reliability. Their infrastructure is backed by AWS’s 99.99% uptime service level agreements and includes multiple firewalls and denial-of-service attack mitigation techniques to protect data from unauthorised access.
Data is encrypted using 256-bit-SSL encryption and sensitive information is encrypted on disk. They also employ HTTPS for secure data transfer.
Employment Hero performs daily full backups every 15 minutes. These backups are stored in multiple locations and are regularly verified and tested to ensure data integrity and recoverability. Furthermore, their servers are only accessible to senior engineers, and all system access is logged and audited.
To comply with data protection laws, including GDPR, Employment Hero has implemented robust data protection measures and appointed a data protection officer to handle privacy-related inquiries and ensure compliance.
Employment Hero stores its data in the AWS Asia Pacific (Sydney) region. This choice ensures that the data is hosted locally within a highly secure and reliable infrastructure. AWS provides robust security measures, including multiple firewalls, DDos protection, and 256-bit SSL encryption for data in transit and at rest.
Third-Party access Agreement
If you still need further reassurance, we can enter into a third-party access agreement based on the above security principles and technologies.
