Reach the desk
+65 6876 3834 [email protected]Monday to Friday, 9:00 AM – 6:00 PM
8 Marina Boulevard, #12-01 Marina Bay Financial Centre Tower 1, Singapore 018981
Security & data protection · Singapore SMEs
Ask vendors
Where the data centres sit, and which sub-processors touch the ledger.
Keep in writing
Hosting location, backup retention, and the export format you can walk away with.
The register
Cloud accounting moves your financial data onto someone else's infrastructure. That is a reasonable trade if you know which controls are in place and which ones you are responsible for. The strip below is the short version; the sections that follow take each one apart.
Control by control
These four show up in every serious cloud accounting platform. The differences are in how they are configured, who can change them, and whether anyone at your company is checking that they still match how the team works.
Encryption
Data moving between your browser and the platform should be encrypted in transit, typically with TLS. Data sitting on the vendor's storage should be encrypted at rest. Both are standard in mature cloud accounting platforms and both should be confirmed rather than assumed.
Ask whether encryption keys are managed by the vendor or by you. The answer affects what happens in a breach scenario.
Ask
Who holds the keys, and what happens in a breach?
Authentication
A password alone does not protect a system that can authorise payments. Multi-factor authentication adds a second factor, usually a code from an app or a hardware key. Enforce it on every account with payment approval rights, and on any account that can export the full ledger.
Check whether the platform supports enforcement at the organisation level, not just per-user opt-in. Organisational enforcement is what actually protects a team.
Ask
Can MFA be turned on for everyone at once, from admin?
Permissions
Role-based access control limits what each user can see and do. In accounting this matters most when the same person can create a supplier, approve a payment, and reconcile the bank. That combination is where internal fraud lives.
A workable structure separates entry from approval, and approval from reconciliation. Most cloud platforms support this. The work is defining the roles and sticking to them as staff change.
Ask
Are custom roles supported, or only fixed permission sets?
Recovery
A backup that has never been restored is an assumption. Ask the vendor how often backups run, how long they are retained, and whether you can restore a specific date range. Then ask whether you can export your own data in a usable format if you leave the platform.
Data portability is a security control. It is also your negotiating position.
Ask
Can you restore one week, or only the whole ledger?
Compare what you are told
Send the same list to each finalist and compare the written answers side by side. A vendor that answers these clearly is a vendor that has been asked before.
The questions to send
Confirm data centre location and any sub-processors.
Send
State the encryption standard used at rest and in transit.
Send
Confirm whether MFA can be enforced organisation-wide.
Send
Describe the permission model and whether custom roles are supported.
Send
Confirm backup frequency, retention, and restore process.
Send
Confirm full data export format and turnaround.
Send
Read the answer for
Data residency determines which country's laws and which physical infrastructure hold your accounting records. For Singapore SMEs this comes up when handling payroll, when clients ask, and increasingly when a vendor's own compliance posture is assessed.
Vendor claims vary. Info-Tech Accounting, for example, highlights Singapore data centres, IMDA-aligned data protection, MTCS compliance, and states ISO 27001:2022 and DPTM certifications on its public materials. That combination addresses hosting location and audited controls together, which is the more useful way to present it. For any vendor, get the hosting location in writing.
Obligations
Under Singapore's PDPA, your company is responsible for the personal data it holds, even when a vendor stores it. That includes customer contacts, supplier representatives, and employee records. You need a lawful basis for collection, a retention schedule, and a process for access and correction requests.
A vendor's certification does not transfer this duty. It supports it.
Records in scope
3 types
Customer contacts, supplier representatives, employee records — each with its own retention rule.
Rights you must answer
Access & correction
You need a named process for both, with a person the customer can reach.
Remote team hygiene
Quarterly
Review the user list, disable accounts the day someone leaves, restrict full-ledger exports, and keep MFA regardless of where the login comes from.
Account hygiene is administrative work, not technical work — and it is where small teams are usually weakest.
The operator brief
Remote access is normal now, and it enlarges the attack surface. Practical measures: disable accounts the day someone leaves, review the user list quarterly, restrict exports of full ledger data, and require MFA regardless of where the person is logging in from.
None of this is technical work. It is administrative discipline, and it is usually where small companies are weakest. Set it up once with a named owner, put a quarterly review on the calendar, and it stops being a problem you revisit every time someone joins or leaves.
Common questions
Two questions come up on nearly every shortlist conversation, and both have a plain answer.
Not inherently. Cloud platforms typically apply stronger encryption, backup, and access controls than a desktop file on an office PC. The risk shifts to account hygiene and how well permissions are configured.
It means knowing which country holds your accounting records. If payroll or client data is involved, that answer affects your own PDPA position and your answers to clients who ask.
A five-person company does not need the same control set as an eighty-person one, but both need MFA, backups, and a permission structure. Scale the depth, not the basics.
Where to go next
Next step
See how the platforms shortlisted for Singapore SMEs answer the security questions on this page — the hosting location, the permission model, the export format, and what each one costs once the team grows.
Compliance
How cloud accounting platforms handle GST registration, filing, and audit trails for Singapore businesses.
If your security questions are specific to your setup — payroll, multi-currency, an existing customer contract with a PDPA clause — the editorial team can point you at the right part of the guide.
Contact the editorial team