You retain ownership
All client data remains owned by you. Acuitas operates on your behalf under the engagement letter, not as the data owner.
Security & data handling
Where your data lives. Who can touch it. What happens when you leave.
You're trusting us with banking access, payroll data, and tax records. The least we can do is be specific about how all three are handled.
Commitments
Four things we don't compromise on.
Encryption in transit
All traffic between you, this site, and our systems uses HTTPS / TLS. The platforms we operate on (Xero, Aspire, Vercel) maintain their own in-transit and at-rest encryption standards.
Role-based access
Client systems are accessed only by the team members who need to do the work. Roles are reviewed at engagement onboarding and at every quarterly review.
Two-factor authentication
All Acuitas-side systems holding client data require 2FA. We use platforms (Xero, Aspire) that support 2FA and we require it for every team member.
Audit logs
Every meaningful change to client books — agent-drafted, reviewer-approved, accountant-signed-off — leaves an audit trail in Xero. Owners can see who did what and when.
Where data lives
A named list of every system that holds client data.
We don't run a black box. The systems below are the only places client data sits — each one has its own published security posture which we rely on alongside our own controls.
| System | Purpose | Where it sits |
|---|---|---|
| Xero | Accounting ledger, bank feeds, reconciliations, reports | Xero's global infrastructure (xero.com privacy + security disclosures) |
| Aspire | Expenditure banking, corporate cards, approvals, vendor payables | Aspire's regional infrastructure (aspireapp.com terms) |
| Vercel | Hosting of acuitas.sg, contact form processing, OG image rendering | Vercel's edge network (vercel.com/security) |
| Resend | Transactional email — contact form submissions delivered to Acuitas inbox | Resend's infrastructure (resend.com/security) |
| Internal workspace | Acuitas-side notes, drafts, working documents | Singapore-hosted productivity tools with 2FA enforced |
Any change in operating platforms is communicated to clients in advance.
How work reaches your books
The control that sits between AI and your ledger.
No entry posts without two humans seeing it after the AI agent has drafted it. The flow is documented per engagement and audited on every close.
Step 01
AI agent drafts
AI agents prepare work — classifying receipts, drafting reconciliations, surfacing exceptions. The agent's actions are logged. Nothing is committed to your books at this stage.
Step 02
Process manager reviews
A human reviewer checks the agent's draft, catches edge cases, and either approves or routes the item back for correction.
Step 03
Qualified accountant signs off
Postings that touch your ledger get a final review and approval from a qualified accountant who carries the accountability for the work.
Ownership & offboarding
You own your data. Leaving is a documented handover, not a hostage situation.
Access ends on offboarding
When an engagement ends, Acuitas-side access to your Xero, Aspire, and other connected platforms is removed. We provide a documented handover of structures, workflows, and any custom agent configurations.
Data retained only as required
Records we are required to retain (typically minimum 5 years from the relevant Year of Assessment) are kept securely. Beyond statutory retention, data is securely deleted or anonymised on request.
No portability lock-in
Xero and Aspire are widely used; you can take your books and banking history with you. We document how the chart of accounts is structured so any future advisor can pick up cleanly.
PDPA posture
We operate under Singapore's PDPA.
Personal data we handle on your behalf is governed by Singapore's Personal Data Protection Act 2012. Our PDPA notice covers consent, purpose limitation, access and correction, retention, transfer, and breach handling.
In the event of a breach
We maintain procedures to assess, contain, and report personal data breaches as required under the PDPA. Where a notifiable breach occurs, we notify the Personal Data Protection Commission and affected individuals within the statutory timelines.
Our DPO is the first point of contact for any security concern: hello@acuitas.sg.
Questions about how we handle your data?
Send them. We answer specifically.
No corporate boilerplate. If you have a specific concern — residency, access, encryption, an audit requirement — write to us and we'll respond with detail.