Updated Checked by the Tax-Services.ca editorial team How we check
Cloud accounting software can be secure enough for a Canadian business, but most of the risk sits with how you set it up, not with the vendor alone. Turn on two-factor sign-in, keep your own backup, and check where the CRA expects your records to live. That last one catches people: records kept only on servers outside Canada don’t count as records kept in Canada.
Is cloud accounting software safe for my books?
A fair answer starts with two things you control and one you don’t. You control who can log in and how. You control whether you hold a copy outside the vendor’s system. You don’t control the vendor’s own data centres. So you ask for proof of how they’re run, and you keep asking if the answers come back thin or vague.
We can’t rank products or vouch for any named vendor, and we won’t try. What we can do is point at the Canadian Centre for Cyber Security baseline controls for small and medium organizations. They call for two-factor authentication wherever possible, and they name financial accounts and cloud administration as places where it matters most.
These methods combine the use of something the user knows (e.g. a password) with something that the user has (e.g. a physical token, an app-generated code, an automated phone call to a telephone number on file).
Baseline cyber security controls for small and medium organizations, cyber.gc.ca
In everyday terms, that’s the six-digit code your phone shows after you type your password. A stolen password on its own then isn’t enough to open your books.
What should a vendor be able to show you?
Before you hand over your books, put these questions to the vendor and read the answers closely. One who can’t answer in plain words is telling you something.
| Ask about | What the official guidance says |
|---|---|
| Independent assurance | The Cyber Centre baseline suggests cloud providers supply an AICPA SSAE 18 SOC 3 report |
| Sign-in | Two-factor authentication for cloud administrators, with passwords different from your internal systems |
| Encryption | Encrypt sensitive information stored outside your own systems |
| Jurisdiction | Look at the provider’s policies on where data is held and who can reach it |
| Backups | Long-term backups offline, frequent ones may stay online, and test a restore |
The baseline is written for organizations generally, not for accounting tools, so use it as a question list and not as a pass mark.
Do the CRA’s rules allow cloud records?
Yes. With a condition. The CRA’s record keeping page says to keep records at your Canadian residence or place of business unless you have permission to keep them elsewhere. Its electronic record keeping circular goes further: records kept outside Canada and reached electronically from Canada don’t meet that rule. The CRA may accept copies made available in Canada in a readable and usable format.
So where does that leave a cloud tool whose servers might be anywhere? It leaves you with a duty to hold a usable copy in Canada. A regular export to your own computer or a Canadian backup does that job. We couldn’t confirm where any particular vendor hosts its data, so ask.
The CRA also says backups should be tested so that the data can be restored into a readable format, and it recommends keeping backup copies at a location within Canada.
A worked example with a six year clock
Say you run a calendar year business and send one invoice for $2,500 in Ontario. The GST/HST calculator puts the HST at $325, for a $2,825 total. The same job in Alberta carries $125 of GST and totals $2,625.
That invoice belongs to the 2026 tax year. The CRA’s page on how long to keep records says to keep them for six years from the end of the last tax year they relate to, so this one has to stay readable until the end of 2032. Will your subscription still exist then? If you cancel the software in 2029, the invoice needs to live somewhere you can still open.
A quieter risk is a lapsed login. Export your books in a common format every year, and keep the file with your other tax papers so it turns up fast at tax time. The self-employed tax calculator is a useful check on those numbers too, though it leaves out GST/HST and EI.
What does a sensible setup look like for a small shop?
Keep it boring. One account per person, each with two-factor sign-in. A password manager so nobody reuses the same password everywhere. A yearly export saved to an encrypted drive at the office, and a second copy somewhere else in Canada. Think of Lena, who runs a small catering company in Kelowna: she turned this on in one afternoon, and her bookkeeper’s access is limited to the files she actually needs. Nothing fancy, and it covers most of what could go wrong.
Common mistakes with cloud accounting
Shared logins are the big one. Owner, bookkeeper and part-timer should each get their own account, and anyone who leaves should lose access that same week. You’re still responsible for your records even when a bookkeeper or service provider keeps them, says the CRA.
Next comes reusing a password from your email or bank, which turns one leak into two or three. Turn on automatic updates for the devices you log in from, because the Cyber Centre baseline says small organizations should enable automatic patching.
And don’t treat the vendor’s backup as yours. If they lock your account over a billing dispute, you want your own file. If payroll runs through the same tool, the payroll remittance calculator gives you a number to compare against what the software reports.
Where this information comes from
Record keeping rules are from the Canada Revenue Agency (RC188 and information circular IC05-1, read in September 2026). Security measures come from the Canadian Centre for Cyber Security baseline controls. The tax figures come from our own calculators using 2026 data. This site has no link with either body.
Frequently asked questions
Can I keep my records only in the cloud?
The CRA says records kept outside Canada and accessed from here don't meet its location rule. Hold a readable copy in Canada, and confirm with the CRA if unsure.
How long must I keep accounting records?
Six years from the end of the last tax year they relate to, unless the CRA gives permission to destroy them earlier.
What is the first security setting to turn on?
Two-factor sign-in. The Cyber Centre baseline recommends it wherever possible, especially for financial accounts and administrators.
Is my bookkeeper responsible for my records?
No. The CRA says you remain responsible even when a bookkeeper or service provider keeps them.
Should I test my backups?
Yes. The CRA expects backed-up data to be restorable into a readable format, and suggests periodic testing.
All family and benefits calculators
- Self-employed taxes in Canada: income, CPP and GST
How tax works when you are self-employed in Canada: reporting income and expenses, paying both halves of CPP, instalments and when to register for GST