Your client stays your client.

01

Scope and responsibility

The division of work is set out in writing before an engagement begins, and it does not move without a change order.

MatchPass does not provide the bookkeeping engagement and does not take over the client relationship.

02

Access we ask for

We work on a least-access basis. The goal at every stage is the minimum access that makes the work possible, and nothing beyond it.

• The free outside-in snapshot requires no access at all. No bank connection, no accounting login. It is built from publicly visible information about how a business takes payments.
• An Exception Assessment can usually run on exports. CSV extracts from the gateway, the ledger and the bank are normally sufficient to quantify the exceptions and the manual effort.
• Read-only access wherever it is technically practical. Where a direct connection is genuinely needed, we ask for read-only scopes rather than full access.
• Access is scoped to the entities and periods in the engagement, not the whole account, and is removed at the end of the engagement.

03

Where the workflow runs

An implemented reconciliation workflow can run on the client's own infrastructure, so the matching engine and exception dashboard sit inside systems the client already controls.

Runs can be scheduled so the reconciliation happens on a defined cadence rather than depending on someone remembering to trigger it.

04

Credentials

Credentials are never requested or accepted over email, chat or any other unencrypted channel. Where access is required, it is granted through the platform's own invitation or permission system so that the client's administrator can see and revoke it directly.

05

Data retention and deletion

Return and deletion of client data are agreed in writing before work starts, and the process is documented as part of handoff at the end of an engagement.

Working data is limited to what the engagement requires. Where an assessment can be completed from a single period of exports, we do not ask for a full historical extract.

06

Logging and audit trail

Matching activity can be logged so that a run can be reviewed line by line after the fact. Each exception carries its reason code and the rule that routed it, which is what makes the output reviewable by an auditor rather than something that has to be taken on trust.

This is a property of the delivered workflow, and what gets logged is agreed as part of scoping.

07

Confidentiality and non-solicitation

Confidentiality is handled through a mutual non-disclosure agreement, and we are glad to sign a firm's own NDA rather than insisting on ours.

Client non-solicitation is part of how we contract on partner engagements. A firm introducing a client is not creating a route for MatchPass to take that relationship.

08

What we do not claim

MatchPass is a small, new practice. We would rather tell you plainly what we do not have than imply a posture we cannot evidence.

• We do not hold SOC 2, ISO 27001 or any comparable third-party certification.
• We do not publish an uptime or availability guarantee.
• We do not currently publish a formal incident-response or breach-notification standard.

If your firm's own risk process requires any of these, say so early. For some firms the right answer is a subcontracted model where the client data never leaves your environment, and we would rather structure it that way than overstate what we carry.

09

Continuity and handoff

Every implementation ships with documentation of the matching rules, the exception logic and the operating process, and a handoff session with the people who will run it.

The intent is that the workflow remains operable by the firm or the client without MatchPass. A care plan is an option, not a dependency created on purpose.