For accountancy practices

Built to ICAEW standard, not retrofitted to it.

Custodiance runs your practice's web and email estate as a managed service, built to the ICAEW Code of Ethics from the first day, with your data stored in UK and EU regions, and run by a named senior engineer you deal with directly. Not a website you buy once and worry about for six years; a custodian who holds it on your behalf.

Request a scoping call Read the methodology

The risk

What ICAEW asks of your public surface

ICAEW does not require a "compliant accountancy website" as a standalone thing. It requires the firm to behave to the Code of Ethics, to comply with the Money Laundering Regulations where supervised, and to disclose its regulatory standing, and the website is where each of those duties is publicly verifiable. A typical agency build satisfies none of them by accident. These are the three places it silently fails.

ICAEW Code of Ethics, Section 114

Confidentiality attaches before the engagement begins

Section 114 imposes an unqualified duty to keep client information confidential. It extends to prospective clients and beyond the end of the relationship, and it is alert to inadvertent disclosure. A website enquiry form is exactly where that duty first bites: a prospect naming a turnover band, an HMRC enquiry, or an unreported-income question hands the practice confidential information the moment it arrives. When that form posts to a US-resident inbox (a HubSpot, Mailchimp, or Typeform embed), the practice has accepted confidential information into a sub-processor chain it cannot defend on a routine review.

Money Laundering Regulations 2017

Client records that must hold up for years, in a place you can name

Where the practice is supervised for anti-money-laundering (by ICAEW, HMRC, ACCA, or the IFA), the MLR 2017 require documented risk assessment, customer due-diligence records, and appropriate security for identification documents. A "send us your records" portal wired to Dropbox, Google Drive, or an S3 bucket in us-east-1 sits in direct tension with that. HMRC's six-year retention window means the exposure compounds: a document uploaded today does not leave the practice's envelope for years, and by year four the practice rarely knows which sub-processor can still reach it.

ICAEW Code of Ethics, Section 114 disclosures

The disclosure surface a reviewer reads before the file

The ICAEW does not require a "compliant website" as an artefact. It requires the firm to behave to the Code, to comply with the MLR 2017, to hold professional indemnity insurance at the prescribed level, and to handle complaints, and the website is the public projection of each of those duties. A reviewer who selects the firm for a sample check reads the site first. Typical agency builds miss the AML supervisory-authority footer block, the regulatory-information and complaints pages, accurate ICAEW trade-mark usage, and last-updated discipline on services pages that hold the firm out as competent on current law.

How Custodiance answers it

An estate mapped to your obligations

Each part of the answer maps to something ICAEW or the MLR 2017 actually asks of the practice: confidentiality on intake, secure and locatable record-keeping, accurate public disclosure, and one named person who runs all of it.

The estate, run as a managed service

Your web and email infrastructure is held and run continuously (hosting, enquiry intake, document flows, the contact list, and the disclosure pages) rather than handed over once and left to drift. Services pages carry a last-updated date and a named review owner, so the firm is never holding itself out as competent on superseded law. The ICAEW evidence pack maps each obligation to the URL on the estate that satisfies it.

UK and EU data residency by design

Client data and hosting stay in UK and EU regions. The enquiry form posts to the estate's own endpoint and is relayed by Scaleway in France to your practice's own mailbox, in your Microsoft 365 or Google Workspace tenant or at Proton in Switzerland, a country the UK and EU recognise as adequate; where submissions are stored, they sit on a server we operate at Hetzner in Germany. Any document-upload flow is scoped with you, built on a UK or EU-resident store and named in your sub-processor schedule before it takes a file, with a retention rule that matches the six years HMRC expects. The contact list lives in a CRM or newsletter platform in your own name, chosen for UK or EU residency, with retention pruning. The US-incorporated providers that stay in the path, Vercel for hosting, GitHub for the source code and Cloudflare for DNS, are named as exceptions. When an AML supervisor, a client, or a finance-director prospect asks where the data lives and who can reach it, the answer is precise, exceptions included, over the full retention horizon.

Sub-processor list · Data processing agreement

A published methodology

The posture is written down, not improvised per project. The same standard that puts your site right is the standard applied to the next practice: auditable, repeatable, and defensible. You can read it in full before you engage, and reference it when your own board or insurer asks how the estate is governed.

A named senior engineer

One senior technical partner runs the estate: a name and a direct line, not a ticket queue. That engineer understands the ICAEW and MLR obligations, does the work between requests, and is the person you speak to when something needs to be put right.

Read the evidence

The detail, in full

Two briefings set out the accountancy-specific position clause by clause: what is wrong on a typical site, and what a regulated-grade estate puts in its place. Read them before a scoping call, and bring questions.

Why your UK accountancy website probably fails ICAEW confidentiality

The four layers where a typical accountancy site silently breaches Section 114 (US-resident enquiry forms, US document portals holding client tax records, US email tools tagged by service line, and practice-management widgets) and what an estate with UK and EU data residency puts in their place.

Read the briefing →

ICAEW Section 114 disclosures: what UK accountancy websites must show

The clause-by-clause disclosure checklist: AML supervisory-authority footer, the regulatory-information and complaints pages, engagement-letter handling, PII disclosure, and ICAEW trade-mark usage: each clause, its audit-pass marker, and the fix.

Read the briefing →

Engage

How to work with us

Growth

Quoted per practice After a scoping call, confirmed in writing

For an established practice that wants its web and email estate run properly, in UK and EU regions, by a named technical partner.

Custody, not marketing.

Have a senior partner look at your estate.

A scoping call is a measured conversation about your ICAEW and MLR obligations, your current setup, and what it would take to run it properly. No obligation, and no pressure.

Request a scoping call