Privacy & third-party access
How AE Partners handles the information you send through the client portal, and exactly who else can see it.
Effective 26 August 2026 · AE Partners · Accountants & Advisers
What we collect
When we send you an information request, the portal collects only what the request asks for: your answers to its questions, any documents you upload, and the comments you leave on a question. We also hold the contact details our practice already has for you — name, email address and phone number — so we can send you the link and remind you about it.
You never create an account or a password. Your access is a single-use link sent to your email address, which expires.
Who else can access your information
We use a small number of service providers to run this portal. They are listed in full below — there are no others, and this list is the whole of it. Each one may only use your information to provide its service to us.
| Third party | What they receive | Why |
|---|---|---|
| Xero Practice Manager Xero Limited | Your name, email address, phone number and address, read from our practice management system to save you retyping them. Where our staff have mapped a question to a Practice Manager field, the answer you give is written back to your client record there. | Practice management. The connection is authorised by our practice through Xero's own consent screen and can be disconnected by us at any time, which erases the stored access credentials. |
| Microsoft Azure Microsoft Corporation | All of it. The application, its database, your uploaded documents and our audit logs are hosted on Azure and stored encrypted at rest in Australia. | Hosting, storage, database, backup and monitoring. Microsoft acts on our instructions and does not use your information for its own purposes. |
| Azure Communication Services Microsoft Corporation | Your name, your email address and the secure link — the contents of the emails we send you. | Delivering request invitations and reminders to your inbox. |
| Microsoft Entra ID Microsoft Corporation | Nothing about you. Our own staff sign in through it; no client information passes through it. | Staff single sign-on, so access to your information is tied to a managed work account. |
We do not send SMS messages from this portal. If that changes, the provider will be named here before it is switched on.
What we never do
- We do not sell your information, and we never have.
- We do not share it for advertising, and the portal carries no advertising or analytics trackers.
- We do not disclose it to anyone outside the list above, except where the law requires us to.
How it is protected
- Everything travels over an encrypted connection and is stored encrypted at rest.
- Your link is single-use and time-limited, and is never written into our logs.
- The credentials that connect us to Xero Practice Manager are themselves encrypted with a key held in Azure Key Vault.
- Every sign-in, permission refusal and integration change is recorded in an audit log that cannot be edited and is retained for at least a year.
- Only our own staff can reach your information, and only through an account with the access their role needs.
How long we keep it
We keep your answers and documents for as long as we need them to do the work you engaged us for, and for as long as the law requires us to keep records of it afterwards. Audit logs are kept for at least one year. When a retention period ends, the information is deleted.
Your choices
You can ask us what we hold about you, ask for it to be corrected, or ask us to delete anything we are not required to keep. Write to angad@aepartners.com.au and we will respond.
If you would rather not use the portal at all, tell us and we will arrange another way to get us what we need.
Changes to this page
If we add a service provider that can access your information, this page is updated before that provider goes live. The effective date at the top tells you when it last changed.