--- title: "Accountant, bank, tax office: where a firm leaves its ground" url: "https://kyberios.com/blog/accountant-bank-tax-office-where-a-firm-leaves-its-ground" description: "Company ground has borders: the external accountant, the bank, the tax authority, the marketplace. How a sovereign system hands data across them without moving itself." --- # Accountant, bank, tax office: where a firm leaves its ground October 22, 2026·4 min read·Editorial team A compact office server with a sealed document envelope leaving through a small front slot, and a rubber stamp beside it Picture a small company that installs heating systems. The office server holds the orders, the stock of boilers and fittings, the invoices and the customer list, and for the first time in years the owner can say where every record is. Then the twentieth of the month arrives. The external accountant needs the month’s sales and purchase invoices in her own program. The bank wants to know who is being paid and how much. The tax office expects a filing in its own format by its own deadline. The marketplace where the company sells spare parts wants stock levels and prices pushed to it every night. Four doors in the wall of “company ground”, and through each of them data has to leave, because the company cannot do business otherwise. The owner’s first instinct is to give each of them a login. The accountant gets an account on the system, the bank integration gets the server’s credentials, the marketplace connector gets read access to everything, so nothing has to be exported by hand. It is convenient for about a month, and then the question “who can see what” has no answer again. ## The real cause: borders treated as doors Keeping data on company ground is not a promise that nothing ever leaves. A firm that trades, pays tax and employs people hands data to other parties every week. The mistake is to treat each border as a door into the system, when it should be a counter across which specific things are handed, one at a time, with a record of what crossed. ## Where the borders go wrong **The accountant gets the whole system.** A login to everything, because it is easier than asking what she actually needs. From that moment the company’s prices, margins and payroll are also on whatever machine she opens them on, and the company cannot say what she has seen. **The bank integration holds the keys.** A connector that can read the ledger and move money is convenient until someone has to explain what it is allowed to do. Read and pay are two different scopes; one credential that does both is a door with no lock. **Exports in the format of the program that made them.** A proprietary file that only the accountant’s software opens is not a hand-over, it is a dependency. When either side changes programs, the history is stuck in the other one. **The marketplace reads more than it sells.** A connector set up to push stock and prices usually has access to orders, customers and costs as well, because the scope offered was “all or nothing” and nobody chose nothing. **Nothing records what left.** Even when each export was reasonable, nobody can list, a year later, which documents went to whom and when. That list is exactly what an audit, a dispute or a data-protection request asks for first. **The system moves to the border to make it easier.** The most common way to solve all of the above is to move the whole ledger to the accountant’s cloud, or the bank’s, or the marketplace’s. Then the border problem is gone, because the ground is. ## What to do instead **Exports in open formats, from one model.** Whatever leaves should leave as a file another program can read without asking the vendor: structured, documented, and the same whether it goes to the accountant, the auditor or a successor system. Since KYBERIOS keeps orders, invoices and stock in one model, the month’s package is drawn from one place, not reassembled from five. **Signed documents, not open sessions.** What the accountant, the bank or the tax office needs is a document the company stands behind: an invoice, a statement, a filing. A signed document can be verified, forwarded and kept; an open session into the system cannot be taken back. **Minimal scopes, written as policy.** The accountant may read sales and purchase invoices for a closed month. The bank connector may read what is due and may propose a payment; it may not execute one. The marketplace may read stock and prices for the items listed there and nothing else. These are lines in the same policy file as everything else, enforced below the agents. [Policy, not prompts](https://kyberios.com/blog/policy-not-prompts-agent-governance) sets out why that is a system property and not a setting. **A log of what left.** Every document that crosses a border is recorded: what, to whom, under which rule, approved by whom. The same mechanism that answers why a record looks the way it does answers what has been handed out. The company’s records of what it gave away are the company’s too. **A person at the border for anything that moves money.** Payments, filings and messages to customers wait for the person who owns that decision. That is the limit the homepage states, and it is the limit that makes the other four workable: the system prepares what crosses, people sign it. **The ground stays where it is.** None of this requires the ledger to move. The accountant’s cloud, the bank’s portal and the marketplace receive what they are entitled to, in a form they can read, and the system that produced it stays on the server the company owns. [Company data on company ground](https://kyberios.com/blog/company-data-on-company-ground) covers what that server is and who holds its keys. ## A test you can run today Draw the wall. On one side, the systems the company runs itself; on the other, every outside party that receives company data: accountant, bank, tax office, marketplaces, carriers, insurers, lenders. For each party, write three things: what they receive, in which format, and how you would know what they have received so far. Where the answer to the first is “they have a login”, the border is a door. Where the answer to the second is “whatever their program exports”, the history is on their ground. Where the answer to the third is “we would have to ask them”, the log does not exist. Each of those is a border that needs a counter, a format and a record, in that order. Before any of that, the order in which a firm connects its own sources matters as much as what it hands outside; [the first week with KYBERIOS](https://kyberios.com/blog/the-first-week-with-kyberios) goes through it. KYBERIOS is pre-launch, and [the homepage](https://kyberios.com/) keeps the honest state of the work. - data sovereignty - accountant - exports - open formats - audit ## Keep reading - [The first week with KYBERIOS: what to connect first](https://kyberios.com/blog/the-first-week-with-kyberios) - [Android XR in a small company: whose platform holds the work](https://kyberios.com/blog/android-xr-in-a-small-company)