Legal & professional services
Accounting firm backup for client records and audit files
Mindtime stores unchangeable copies of your firm's mailboxes, file shares, servers and laptops in its own Tier III data centres in the Netherlands and Germany. Each backup job is checked, and an air-gapped copy stays out of reach of attackers.
In Dutch, German or English.
- NL · DEStored only in our own Tier III data centres in the Netherlands and Germany
- ImmutableObject Lock storage plus an air-gapped copy; every backup job is checked
- ISO 27001 · NEN 7510Audited security, with a data processing agreement in every contract
- NL · DE · ENSupport from people, no offshore call centres or chatbots
In short
Accounting firms need backups that last for years, because audit files must be kept at least seven years after closing and client administrations fall under the seven-year tax retention duty. Mindtime keeps immutable, monitored copies of your Microsoft 365 or Google Workspace, servers and laptops in its own data centres in the Netherlands and Germany.
What's at stake
The data accounting firms can't afford to lose
Closed audit files
A controledossier documents the evidence behind an audit opinion. If it is lost after closing, the firm cannot show the work behind that opinion to a quality reviewer or a court.
Client ledgers and tax returns
Year-end workpapers, VAT returns and income tax filings are built on your clients' ledgers. When those copies vanish in the busy season, deadlines slip for every client at once.
Payroll data
Payslips, employee records and wage tax returns contain BSNs and salary details. A leak or loss affects your clients' staff, not just your client.
Rules and obligations
What the rules ask of accounting firms
Summarised from the sources listed at the bottom of this page. This is general information, not legal advice.
Audit files: close within 60 days, keep seven years
Article 11 of the Besluit toezicht accountantsorganisaties requires the audit file to be completed and closed no later than 60 days after the auditor's report is signed. The firm then keeps it for at least seven years after closing. [1]
Seven-year tax retention
The Belastingdienst requires business records to be kept for seven years, and data on real estate for ten. Basic data such as the general ledger and the accounts receivable and payable always fall under the seven years. [3]
Wwft: BFT supervises, records kept five years
Accountants are institutions under the Wwft and BFT supervises their compliance. BFT's guidance says client due diligence data must be recorded and kept on file for five years after the transaction or the end of the client relationship. [4]
NIS2: not in scope, but your clients may be
Accountancy is not in the sector list of the Cyberbeveiligingswet, the Dutch NIS2 law in force since 15 August 2026. Clients that are in scope must secure their supply chain, including direct service providers, so expect security questions from them. [6]
When it goes wrong
A phishing link in the busy season
Illustrative example: in May, an assistant at a ten-person accountancy firm opens a fake invoice and the attacker deletes folders from SharePoint and empties several mailboxes. The firm's own recycle bins are emptied too. Because Mindtime keeps immutable copies outside Microsoft 365, the deleted client folders and mail are restored from the last checked backup. The firm then reviews with its IT partner whether personal data was exposed and whether the incident has to be reported.
How Mindtime protects it
Backup for accounting firms, workload by workload
- Microsoft 365 backupClient mail and SharePoint year-end folders are the firm's daily working archive.
- Google Workspace backupSmaller firms often exchange documents with clients through Gmail and Drive.
- VMware and Hyper-V backupLocally installed audit and tax software often runs on a virtual server in the office.
- Database backupPractice and workpaper software installed on your own server usually keeps its data in a database that needs a consistent copy.
- Laptop and endpoint backupStaff work at client premises and at home, with files saved locally on laptops.
- Disaster RecoveryA system outage in the weeks before a filing deadline hits every client at once.
The software you use, and what we protect around it
| Exact Online Accountancy | Online software for the firm's administrative services to clients. For SaaS like this, check Exact's export and retention terms; Mindtime protects the mail, workpapers and laptops around it. |
|---|---|
| Twinfield | Wolters Kluwer's online bookkeeping for firms and entrepreneurs. Mindtime does not back up Twinfield itself; it protects the exports, workpapers and correspondence you keep in Microsoft 365 or Google Workspace. |
| Loket | Online HR and payroll platform used by accountancy firms. Check Loket's export terms, and keep the payroll reports you download inside a backed-up mailbox or file share. |
| Audit workpapers on a file server | Many firms still keep audit software and workpapers on a local VMware or Hyper-V server or a NAS. Mindtime backs up that server or NAS off-site. |
| Microsoft 365 or Google Workspace | Where client correspondence, signed engagement letters and shared year-end folders live. Mindtime backs up both platforms to its own data centres. |
Google Workspace
Google Workspace backup for accountancy firms
Some accountancy firms run on Gmail and Google Drive, collecting receipts by mail and sharing year-end folders with clients. Google's own trash and Vault are not designed to bring a whole firm back after deletion or an attack.
- Drive deletes items permanently once they have been in the trash for more than 30 days, and an admin can only recover them for 25 days after a user empties the trash.
- Google's Vault FAQ says plainly that Vault isn't designed to be a backup or archive tool, and that it has no automated way to restore exported data.
- Deleting a departed employee's account removes all data associated with it from Google, including the client folders that person owned.
- Mindtime backs up Gmail and Drive to its own Dutch and German data centres, and you can try it free for 7 days.
Before you switch
What accounting firms ask us first
Exact and Twinfield are in the cloud. Why back up anything?
Those platforms protect their own service. Your workpapers, mail, signed engagement letters and laptop files are elsewhere, and that is where most incidents happen. Mindtime covers those with immutable copies in the Netherlands and Germany.
Will this take time from our staff during the busy season?
No routine work is needed from your team. Mindtime checks every backup job and monitors the platform 24/7, and when you do need a restore you speak to Mindtime's own staff in Dutch, German or English.
Our clients ask where their data is kept. What do we tell them?
That it stays in Mindtime's own Tier III data centres in the Netherlands and Germany, under a data processing agreement, with ISO 27001 and NEN 7510 audits. Those are concrete answers for a client's supplier questionnaire.
FAQ
Questions about backup for accounting firms
How long should an accounting firm keep its backups?
Long enough to cover the longest retention duty that applies to the data. Closed audit files must be kept at least seven years after closing, tax records seven years and real-estate data ten. Agree a backup retention period per data type and write it down, so you can explain your choice to a supervisor.
Is a Microsoft 365 recycle bin not enough?
No. Recycle bins and retention settings live inside the same tenant an attacker or a careless admin can reach. A separate backup in another environment, with immutable storage and an air-gapped copy, is what lets you restore after deliberate deletion. Mindtime offers a 7-day free trial to test this with your own mailboxes.
How is our backup data secured?
Data is encrypted in transit with AES-256, admin actions require MFA, and backups are stored immutably with Object Lock. Before a restore, backups are scanned for malware and can be restored in an isolated environment. Mindtime is audited against ISO 27001 and NEN 7510.
Can Mindtime help when a client asks about NIS2?
Mindtime helps with the backup and recovery part. If a client is covered by the Cyberbeveiligingswet and asks how you protect its data, you can point to immutable off-site backups, quarterly disaster recovery tests if you take DR, and the data processing agreement. The rest of your security policy remains your own responsibility.
See it with your own data
Book a 15-minute demo
We show you a backup and a restore, and answer your questions in Dutch, German or English. No offshore call centres, no chatbots.