TPB and ATO expectations
Confidentiality obligations, mandatory MFA in practice software and breach reporting to the ATO.
For accounting firms
Your clients' TFNs and financials, locked down.
Accountants and bookkeepers hold tax file numbers, financial statements and identity documents, everything an identity thief needs. We secure your practice so your clients' data and your registration stay safe.
Limited onboarding slots each year. Every application is reviewed.
The problems we fix
What keeps accounting firms up at night.
Identity-theft target
TFNs, myGov access and lodgement credentials are worth a lot to criminals.
AML/CTF obligations
New customer due-diligence records to collect and protect from 2026.
Tool sprawl
Practice management, tax, document, e-signature and portal tools, all holding client data.
What you get
Handled for you.
- Locked-down access to tax and practice software with phishing-resistant MFA
- Secure client portals and document exchange instead of email attachments
- Breach-response processes that cover the OAIC, the TPB and the ATO
- One bill for every subscription your practice runs on
Fixed price. One bill.
We pay for all your cloud subscriptions and IT costs, and you get one convenient bill every quarter. No hourly rates, no surprise invoices.
The rules that apply
Obligations we help you stay on top of.
We align your IT to the expectations below. This is general information, not legal advice.
Tax Practitioners Board Code of Professional Conduct
Code item 6 requires you to keep client information confidential, and the TPB considers whether practitioners had sufficient IT controls when a breach happens. The ATO also expects MFA and breach reporting from tax practitioners.
Source: TPB(opens in a new tab)AML/CTF reforms (Tranche 2)
Since 1 July 2026, lawyers, accountants and real estate agents providing designated services have AML/CTF obligations, including collecting customer identification. Protecting those records brings Privacy Act and breach-notification obligations with it, regardless of business size.
Source: AUSTRAC(opens in a new tab)Notifiable Data Breaches scheme
Organisations covered by the Privacy Act must notify the OAIC and affected individuals of eligible data breaches. 2025 saw a record number of notifications, most of them caused by malicious or criminal attacks.
Source: OAIC(opens in a new tab)ASD Essential Eight
Australia's baseline strategies for stopping cyber attacks. We align your environment to Maturity Level 1 or 2, the levels cyber insurers increasingly ask about.
Source: ASD's ACSC(opens in a new tab)Your software
We manage the apps you already use.
Product names are shown for identification only and belong to their respective owners.
- Xero Practice Manager / Xero Tax
- MYOB Practice (AE / AO)
- HandiSoft
- CCH iFirm
- APS
- FYI
- BGL (Simple Fund 360 / CAS 360)
- Class
- Karbon
- Ignition
- Dext
- NowInfinity
- SuiteFiles
- Microsoft 365
- Google Workspace
- Xero
- MYOB
- QuickBooks
- DocuSign
- Adobe Acrobat
Ready to hand over IT for good?
We only take on a limited number of accounting firms each year. Join the waitlist to secure your place in the queue.
Join the waitlist