Security & privacy

Overview

OneHQ is built for Australian accounting practices handling sensitive financial data — ABNs, TFNs, bank details, payroll records, and tax lodgement information. Security is built into every layer of the application, from infrastructure to application design.

OneHQ’s database, and the documents OneHQ itself keeps, such as its copy of each signed document, are hosted in Australia. Your practice’s files stay in your own Dropbox, OneDrive or SharePoint. The platform is designed around the principle of least privilege — every user, integration, and system component has access only to what it needs, and nothing more.

Key security measures include:

• Australian-hosted infrastructure — OneHQ’s database and the documents OneHQ itself keeps are stored in Sydney
• Practice-scoped isolation — every request is bound to one practice before it reaches any data
• Encryption at rest and in transit — TLS/HTTPS everywhere
• Role-based access control — four configurable roles (Partner, Accountant, Administration, Bookkeeper) with granular permissions
• Immutable audit logging — 7-year retention
• OAuth 2.0 integrations — minimum required scopes, revocable at any time

Data hosting

OneHQ’s own data is hosted on Australian infrastructure via Amazon Web Services (RDS PostgreSQL, Sydney — ap-southeast-2). Client records, authentication, audit logs and the documents OneHQ itself keeps, such as its copy of each signed document, all stay in Sydney. Some features use services overseas — SMS, card payments, address lookup, and integrations your practice chooses to connect, such as Dropbox, Microsoft 365 or Google. Each one, what it receives and where, is listed in our Privacy Policy (sections 11 and 12).

This includes:

• Client data — entities, contacts, ABNs, TFNs, financial records, jobs
• Authentication data — user accounts, sessions, JWT tokens
• File metadata — document references, signing records, communication logs
• Audit trails — security logs, integration authorisation records

Your practice’s files — client documents, and the signed copy filed to each client’s folder — stay in your own Dropbox or OneDrive/SharePoint, which provides its own enterprise-grade security and encryption. They are kept wherever that service keeps them, so not necessarily in Australia: Dropbox, for one, may process files in the United States. Your practice controls the connected account and can disconnect at any time.

Practice isolation

Every practice’s data is isolated. Practice A cannot see, query or access Practice B’s data.

Every record in the database carries the practice that owns it. Every authenticated request is resolved to exactly one practice before it is allowed to reach any data, and every query is scoped to that practice. This means:

• A user can only read rows belonging to their practice
• Queries that attempt to access another practice’s data return zero results
• Access is enforced on the server, on every request — it is not something the browser can ask to skip

Authentication & access control

AWS Cognito handles authentication with email and password. A signed-in session is held in a server-side session store and carried by a secure, HTTP-only cookie — no long-lived credential is kept in the browser where a script could read it. Two-factor authentication with an authenticator app is mandatory for every user. A lost authenticator is recovered with a one-time backup code or reset by the practice owner; a locked-out sole owner is recovered only through OneHQ, by a checked, audited break-glass, never by a self-service path around it. Changing a password signs that person out everywhere.

Role-based access control

Every staff member is assigned one of four roles, each with configurable permissions:

• Partner — full access to clients, jobs and settings
• Accountant — access to assigned clients and jobs
• Administration — reception and administration: the whole client list by name, with financial detail scoped to assignment
• Bookkeeper — access scoped to bookkeeping work and its clients

Permissions are configurable per role in Settings > Users & Permissions. Admins can customise what each role can see and do across the application.

Session management

Active sessions are tracked. Each person can see their own active sessions and recent sign-ins and sign out every other device, and deactivating a staff member ends their sessions straight away. A session ends after 30 minutes of inactivity, and after 12 hours at most.

Invite-based onboarding

New staff members are added via invite links, ensuring only authorised people can join a practice. Invite tokens are single-use and hashed using SHA-256 before storage.

Encryption

Data is encrypted at rest and in transit:

• At rest — AWS provides managed encryption for all stored data, including backups
• In transit — all connections use TLS/HTTPS. API calls between the frontend, backend, and external services are all made over TLS

Sensitive fields such as Tax File Numbers (TFNs) are handled with additional care in accordance with the Privacy (Tax File Number) Rule 2015. OAuth tokens for integrations (Xero, Dropbox, Gmail, Microsoft) are stored encrypted and are never exposed to the frontend.

Audit logging

An immutable audit log records security-relevant actions across the practice. The audit_log table is practice-scoped and append-only — entries cannot be modified or deleted, even by administrators.

Logged actions include:

• User authentication events (login, logout, failed attempts)
• Permission changes and role assignments
• Integration connections and disconnections
• Data access and modification events
• Session management actions (revocation, expiry)

Audit logs are retained for 7 years per ATO DSP requirements, providing a complete trail for compliance reviews and security investigations.

AML/CTF compliance

OneHQ includes a built-in AML/CTF verification module for identity verification of clients and associated persons. It is built to support your Tranche 2 obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006. ID checks, PEP and sanctions screening and ASIC searches run through Global Data, and are charged per use: $5.50 + GST per ID check, 100 PEP checks a month included then $0.50 + GST per check, $18 + GST per ASIC search.

The module supports:

• Primary and secondary ID verification — record and track identity documents for each person
• Customer Due Diligence (CDD) levels — standard and enhanced due diligence, with a high-risk client moved to enhanced automatically
• PEP and sanctions screening — run automatically once a person’s ID check passes (a practice can turn this off), with the outcome recorded and a possible match flagged to staff
• Reverification schedules — configurable re-check and re-screening periods, with each one listed when it falls due
• Escalation workflows — route complex or high-risk verifications for senior review

AML/CTF settings are configurable per-practice in AML settings on the AML page. You can enable or disable the module, configure designated services, set reverification periods, and choose whether to require secondary identification.

All AML/CTF actions are logged in a dedicated audit trail (aml_audit_log), separate from the general audit log, providing a complete record of verification activities for regulatory review.

Integration security

Integrations connect with OAuth 2.0 wherever the provider offers it, asking for the scopes each feature needs. OneHQ never stores the passwords to your third-party accounts — only OAuth tokens, or the API key a provider issues for the purpose, all stored encrypted and revocable at any time.

Xero

OneHQ reads Xero to power its compliance work, and writes back only where you ask it to — posting a journal an accountant has reviewed, recoding a transaction, recording a bank transaction from a OneHQ tool, or authorising a draft invoice you choose to send. It never edits contacts, bank feeds or pay runs. See the Xero integration guide for full details.

File storage — Dropbox or OneDrive

File storage and document management run on your practice’s own Dropbox or OneDrive/SharePoint. OAuth access is scoped to the connected account, and file operations are performed on behalf of the authenticated user.

Email providers (Gmail / Microsoft)

Two connections, two scopes. Your Email reads a staff member’s own mailbox so client emails file to the client’s record — read-only, it cannot send. Team Email is the firm’s shared mailbox that one-off and campaign emails go out from. Both use OAuth 2.0 with Gmail or Microsoft Graph, and each asks only for what it does. Email content is rendered server-side and sent directly via the provider’s API.

SMS

OneHQ’s own SMS is the default: it runs on Twilio, a US company, from an Australian number set up for your practice. A practice can instead connect its own ClickSend account (an Australian company, processed in Australia) or its own Twilio account. Any credentials are stored encrypted and configurable in Settings.

Token management

All OAuth tokens are stored encrypted in the oauth_tokens table, scoped to the practice. Tokens are automatically refreshed when they expire. You can revoke any integration at any time from Settings > Integrations.

Connecting and disconnecting an integration are recorded in the audit log, with which staff member did it and when.

Frequently asked questions