Online Accounting
Cloud Accounting in Canada: Records, Privacy and a Safer Migration
Assess cloud accounting through CRA record-location rules, privacy accountability, permissions, exports and migration checks for Ontario small businesses.
Sources checked: . General educational information; no individual professional review is implied.
On this page
Online accounting can make collaboration, document collection, and reporting easier, but the choice of a cloud system is also a records and information-governance decision. An Ontario business needs to understand where information is stored, who can access it, what can be exported, and what happens if a provider or staff relationship ends. Convenience does not transfer responsibility for tax records or personal-information handling to the software supplier.
This guide offers a practical assessment and implementation plan for ordinary small businesses. It does not recommend a particular vendor or claim that a product is automatically compliant, secure, or approved by CRA. CRA's records-location and retention guidance and the Office of the Privacy Commissioner of Canada's outsourcing guidance support the regulatory discussion [1][2]. Privacy-law applicability depends on the organization and information involved. Obtain advice for your circumstances, particularly where sensitive, regulated, or cross-border information is involved.
Define the problem before choosing a platform
Start with the work you need to improve: collecting invoices, reconciling accounts, collaborating with an adviser, reporting by project, or maintaining access during staff absences. Document the current bottlenecks and required outputs. A platform demonstration can be appealing without solving the real problem, especially if the business's intake and approval processes are undefined.
List the records and systems involved. Sales, supplier invoices, payroll, banking, customer details, and financing information may sit in different tools. Identify which system is the authoritative source for each type of information and how data moves between them. Duplicated entry and unclear ownership can create inconsistent reports even when every individual tool works as advertised.
Set requirements for usability, permissions, reporting, exports, support, record location, and continuity. Separate essential capabilities from attractive extras. A small service business may not need the same functions as an inventory-heavy operation. The objective is a proportionate system that supports reliable records and review, not a claim that moving online automatically improves accuracy or reduces every cost.
Check CRA's records-location requirements
CRA states that records must be kept at the place of business or residence in Canada unless written permission is given to keep them elsewhere. Records kept outside Canada and accessed electronically from Canada are not considered records kept in Canada [1]. This distinction is important when evaluating cloud platforms, backups, or outsourced record storage.
Ask the provider where relevant records are stored and what the service contract says. Do not infer location from a Canadian billing address, a website domain, or a sales representative's general statement. Identify whether the business's arrangement meets CRA's guidance or requires written permission. The correct analysis can depend on the actual records and storage setup.
If permission to keep records outside Canada is needed, follow the official process and applicable terms. CRA explains conditions concerning availability in Canada and readable electronic records [1]. A provider's ability to display a dashboard is not necessarily the same as supplying usable records for review. Obtain advice before assuming that online access or a downloaded summary resolves the location issue.
Treat privacy outsourcing as a separate question
The Office of the Privacy Commissioner explains that PIPEDA does not prevent outsourcing of processing, but organizations subject to it must take reasonable steps to protect personal information in a third party's hands [2]. The business remains accountable. Privacy considerations therefore belong in the provider assessment, not only in a general statement on the website.
The guidance also addresses clear notice when information may be processed in a foreign country and accessible to that jurisdiction's authorities [2]. A contract cannot override foreign law. Review whether notices and practices accurately reflect the actual arrangement. Do not claim that Canadian tax-record compliance automatically establishes privacy compliance, or vice versa; they concern different obligations.
Determine which privacy laws apply to the information and activities involved. Payroll data, customer information, and sector-specific records may require different analysis. This guide does not make that legal determination. Use the linked guidance and appropriate advice to identify the business's responsibilities, then document the provider assessment and the controls selected.
Examine the provider beyond the feature list
Ask about access controls, authentication, staff safeguards, subcontractors, incident procedures, backup arrangements, data exports, and termination rights. The privacy regulator's outsourcing guidance emphasizes reasonable protection and confidence in the processor's policies and processes [2]. Request documentation proportionate to the sensitivity and importance of the information rather than accepting a broad assurance that the cloud is secure.
A useful evaluation records the question, evidence received, remaining uncertainty, and responsible decision-maker. Distinguish independently supported information from marketing claims. For example, a statement about encryption may not answer who can access decrypted records or how account recovery is controlled. A security feature's existence does not prove that it is enabled correctly for your account.
Review costs and contractual consequences of leaving as well as joining. Can you export transaction details and documents? How long is access available after cancellation? Are there additional export charges or limitations? A workable exit plan is part of choosing the system. It prevents the business from discovering too late that retained records are available only through an active subscription.
Keep individual access and sensible permissions
Give each authorized user their own account and access appropriate to their role. Avoid shared credentials that make activity difficult to attribute and departures difficult to manage. Use strong authentication options, including multifactor authentication where supported, and protect recovery methods. These are practical safeguards, not a claim that any one setting prevents every incident.
Separate permission to enter transactions from permission to release payments or administer users where the system and staffing allow. A person who uploads supplier invoices may not need access to confidential payroll information. Review permissions after role changes and promptly when people leave. An external adviser should have the access needed for the engagement, not unrestricted control by default.
Maintain a business-owned administrator and a continuity arrangement. If the only administrator uses a personal email address or unavailable device, the business can lose access at a critical moment. Keep recovery details securely and test the approved process without exposing credentials. Appropriate access supports accountability and dependable records as well as confidentiality.
Design integrations with a reconciliation point
Bank feeds, sales platforms, expense tools, and payroll integrations can reduce routine entry. They can also duplicate transactions or import incomplete information if ownership is unclear. Document what each integration transfers, how often, and which system makes corrections. Establish a reconciliation point so that the business can detect omissions rather than assume an automated connection is always complete.
For a hypothetical example, a sales platform reports $4,000 in customer collections and retains $120 in fees before depositing $3,880. A bank feed showing $3,880 alone does not provide the full transaction explanation. The books need the appropriate gross amounts, fees, refunds, and tax details under the actual facts. The integration should preserve those details or have a documented reconciliation process.
Test ordinary transactions and exceptions before full use. Include refunds, credits, duplicates, transfers, and failed imports. Keep a record of the test and results. The aim is not to demonstrate that the systems can connect once, but that the end-to-end records remain understandable. Automated processing still needs review, especially when tax codes or unusual transactions are involved.
Preserve the source-document trail
A useful online system connects ledger entries with readable invoices, receipts, agreements, and relevant reports. Document-capture tools can assist, but images should be checked for completeness and clarity. Do not assume that an extracted amount preserves every fact needed for review. An invoice may contain tax information or a description that automated extraction misses.
Use an approved intake route and a missing-document process. A transaction should be flagged when evidence is absent or unclear, rather than confidently coded based on the vendor name. Review business purpose and mixed use where relevant. The record-keeping guide explains why a payment record alone may not establish the correct expense or input tax credit treatment.
Keep a traceable correction history. If a transaction changes, record the reason and authorization appropriate to the business. Avoid overwriting documents or deleting entries solely to improve the appearance of reports. Reliable online accounting should make it easier to explain decisions, not hide the sequence of events behind a convenient dashboard.
Test exports before relying on them
Export capability matters for retained records, adviser review, migration, and business continuity. Identify the transaction detail, attachments, reports, and history that can be retrieved. Test the actual export, open the files, and verify that amounts and references remain usable. A button labeled download does not establish that everything the business needs has been preserved.
Take a sample historical invoice and trace it through the exported transaction list, attachment, payment, and reconciliation. Repeat with a refund and a payroll summary if applicable. Identify missing fields or inaccessible documents before cancelling the old service. The test frequency should suit risk and change; this is a suggested control, not a prescribed statutory testing interval.
Keep relevant file formats and software access arrangements in mind. A summary PDF can be readable while lacking the underlying detail needed for verification. CRA's guidance describes availability and readable electronic records where storage arrangements require permission [1]. Discuss requirements with your adviser rather than assuming a report designed for management is sufficient for every regulatory purpose.
Apply retention and deletion together
CRA generally requires records and supporting documents for six years from the end of the last tax year they relate to, with important exceptions and longer retention for some historical information [1]. The retention policy should identify record categories and triggers. Do not delete everything six years after upload, and do not retain every personal detail indefinitely without considering privacy and other obligations.
Ontario's employment-record guidance sets different periods for specified payroll and employment information, including generally three years for certain hours and wage-statement records and generally five years for vacation records [3]. Where federal tax and provincial obligations overlap, determine how to meet them together. Keep records subject to relevant disputes or holds until the applicable requirements are resolved.
Document approved deletion procedures and who authorizes them. Provider defaults should not silently override the business's schedule. Confirm what happens to backups and exported copies where relevant. Early destruction of CRA-required records requires written permission, and CRA cannot authorize destruction under laws it does not administer [1]. Obtain advice before a large cleanup or migration removes historical information.
Prepare for outages and information incidents
Plan how the business will operate if the system is unavailable during payroll, invoicing, or a filing period. Identify essential reports, approved contacts, backup access, and alternative procedures. Do not make emergency copies of sensitive information in unapproved tools simply because the normal platform is temporarily unavailable. Continuity should preserve both usability and appropriate safeguards.
The incident plan should identify who assesses an event, preserves evidence, contacts the provider, and obtains privacy or legal advice. Not every technical problem has the same consequence. A lost connection, an unauthorized login, and accidental disclosure require different responses. Record what happened and avoid unsupported assurances to affected people before the facts are understood.
This article does not determine reporting or notification duties for a specific breach. Applicable law and the circumstances must be reviewed promptly. The outsourcing guidance is a starting point for understanding accountability, not a complete incident-response manual [2]. Practical preparation can reduce confusion and delay, but it cannot guarantee that incidents will never occur.
Migrate in stages with clear ownership
Before migration, reconcile the old system and agree the transition date. Identify opening balances, customer and supplier details, tax balances, payroll information where applicable, and source documents to preserve. Assign responsibility for each dataset and for checking the imported result. A clean-looking new dashboard does not prove that historical balances were transferred accurately.
Use a controlled test before retiring the previous system. Compare selected reports and transactions, review duplicates, and confirm tax-code mapping. Maintain access to retained old records according to the applicable requirements. Document differences and their resolution. If migration occurs during a reporting period, clarify which system produces the authoritative return or report so information is not counted twice or omitted.
Train users on the actual approved workflow, permissions, and exception process. LMAR's online-accounting and training pages describe relevant support. Bring your system list, record-location information, provider terms, and migration concerns to a discussion. Online tools can improve collaboration, but reliable records, appropriate privacy practices, and professional judgment remain essential. Verify current official guidance and your facts before adopting, cancelling, or materially changing a service.
Official sources & research dates
Numbered references link to the official pages below. Source page modification dates are shown only where supplied by the publisher. A source-check date is not a professional sign-off, and rules may change. Some BDC downloads require a form; their linked explanatory pages are publicly readable.
- Where to keep records, for how long, and permission to destroy them earlyCanada Revenue Agency · Checked October 18, 2026 · Source modified August 3, 2026Back to sources
- Privacy and outsourcing for businessesOffice of the Privacy Commissioner of Canada · Checked October 18, 2026 · Source modified September 16, 2026Back to sources
- Employment Standards Act guide: record keepingGovernment of Ontario · Checked October 18, 2026 · Source modified February 5, 2026Back to sources