Shared database or your own server: where your firm’s client data lives, and why it matters

Shared systems and dedicated servers

In a shared, or multi-tenant, system, every customer’s records sit in the same databases and the application keeps them apart. This is efficient and can be very secure when it is built well. The separation, though, depends on the software being right every time.

With a dedicated server, each firm has its own virtual machine and database. Another firm’s account is not just hidden from yours; it is somewhere else entirely. Updates and backups are handled per firm.

Questions to ask any vendor

1. Is my firm’s data in a database shared with other firms, or in its own?
2. In which country are the servers, including backups?
3. Who develops and supports the software, and from where?
4. How are security updates applied, and how quickly?
5. What happens to my data, and how do I get a copy, if I leave?

Your obligations stay with your firm

Tax and accounting firms have their own duties: the FTC Safeguards Rule requires a written information security program, IRC §7216 limits how tax return information is used and disclosed, and states such as New York and California add privacy and security requirements. Software can be built to support these obligations, but no vendor can make a firm compliant on its own. Your firm still decides who has access, manages its users and devices and keeps its own written information security plan.