A cloud accounting stack for a firm that uses an offshore team
A cloud accounting stack that works with an offshore team has five layers: the ledger, practice management, documents and workpapers, receipt capture with bank feeds, and lodgement. You don't need different software for overseas staff. You need every layer to give each person a named login with MFA, access set client by client, a log of what they changed and a work queue you can measure.
Below: what each layer does, and what the vendors publish about logins, MFA and audit trails, checked on 8 November 2026. We don't rank them.
Serkan Honeine, Co-founder, CoSauce
Published · Last updated
What changes when some of the people sit overseas
You can't look over the person's shoulder, so the tools have to show you what you'd otherwise see. Five things to check in every layer:
- A named login for every person, in every tool. Nobody shares a password, including the firm owner.
- Multi-factor authentication on each of those logins.
- Access set client by client, so a bookkeeper sees the 15 files they work on and not the other 200.
- A log of who changed what and when, that you can open yourself.
- A work queue with time against each job, so you measure turnaround and rework rather than guess.
Two of these, MFA and restricting administrative privileges, are among the Australian Signals Directorate's Essential Eight strategies (ASD, Essential Eight explained). The fifth turns an offshore hire from a cost you hope is working into a number you read each week. Your TPB and privacy obligations sit on top; we cover those in how to move your firm to offshore bookkeeping.
The ledger in Xero, MYOB and QuickBooks Online
The ledger is where logins and logs matter most. What each vendor publishes (Xero MFA FAQ, Xero security, MYOB manage users, MYOB security, QuickBooks user roles, QuickBooks audit log, QuickBooks AU pricing).
| Ledger | Logins and roles | MFA | Change log |
|---|---|---|---|
| Xero | Users are invited into each organisation. The MFA FAQ says to invite a person as a new user rather than share a login. | Required for everyone with access to an organisation. Payroll-only employees are exempt. Xero Verify or another authenticator app. | The AU security page covers ISO 27001:2022 and SOC 2 reports but not the change history, so check the History and notes report in your own file. |
| MYOB Business | User types are Owner, Online admin, Advisor and File User. Roles such as Administrator, Banking, Sales, Purchases and Payroll are set when you invite someone. The Users page has a remove user access action. | Passkeys recommended, with an authenticator app plus SMS as backup. Email 2FA is not recommended and will be phased out in 2027. | Not described on the user management or security pages we checked. |
| QuickBooks Online | Roles include primary admin, company admin, standard all access, in-house accountant, AR and AP manager, reports only and time only. Plans carry 1, 3, 5 or 25 users; two accountants are free (three on Advanced). | Not described on the pricing or roles pages we checked. | Records all account activity, not only transactions. Cannot be turned off, keeps two years of events, filters by user, date and event. Admins can view it. |
Two things stand out for an offshore team. QuickBooks is the only one of the three whose public help pages spell out an audit log you can't switch off. Xero's FAQ says MFA is required for everyone with access to an organisation; MYOB's security page describes passkeys and 2FA without saying who must use them. Ask both what is enforced on your account, and where we say "Not described", ask the vendor. On QuickBooks Online Accountant, custom firm roles also set view, create, edit and delete rights per area for your own team (QuickBooks custom firm roles).
Practice management is the work queue
This is the layer most firms skip when they hire offshore, and the one that makes the hire measurable. Accounting practice management software gives each job an owner, a due date and time logged against it, so a weekly review looks at turnaround and rework instead of a feeling (Xero Practice Manager, Karbon, Karbon permission levels, FYI security).
Xero Practice Manager
Assign jobs to staff and monitor progress, log time by duration or start and stop, report work in progress, invoice through your Xero organisation. Tax and Workpapers included. $163.90 a month for up to 10 users including GST, free at Silver, Gold or Platinum partner status. The page does not describe staff permission levels.
Karbon
Project management, connected email, workflow automation and time tracking. Three permission levels. Admin has settings and data exports. Standard, the default for a new user, has neither. Restricted sees only its own to-do list and the contacts and work it is assigned, and can only create work for clients it has access to. Karbon wrote that Restricted suits temporary contracted staff or outsourced teams.
FYI
Document management plus workflow and automation, built around Xero. In-app user permissions control what data a user can access. Data sits in AWS data centres in Sydney and London, encrypted with AES-256 at rest and TLS in transit, ISO 27001:2022 certified. MFA comes through Microsoft 365, so it is only as strict as your Microsoft 365 policy.
The question to ask any practice management vendor is the one Karbon answers on its own page. Is there a role that limits a person to the clients and jobs they're assigned? If everyone sees everything, you're relying on trust rather than settings.
Documents and workpapers
Client documents are where the sensitive files sit: ID documents, payroll, trust deeds. Look for permissions by folder or cabinet rather than one open drive, encryption at rest and a stated data location. FYI publishes all three (FYI security). Xero's Workpapers come with Xero Practice Manager at no extra cost. Whatever you use, client documents don't go to personal devices or personal email.
Receipt capture and bank feeds with Dext and Hubdoc
Capture tools are where much of an offshore bookkeeper's day goes, and they keep their own user lists. Dext syncs to Xero, QuickBooks Online, Sage and Zoho, and says you can control access levels and monitor submissions, with permissions on a least-privilege basis (Dext AU). Hubdoc captures bills and receipts into Xero with the source document attached, and is included in Xero's paid plans above the entry tier (Hubdoc on the Xero App Store). That listing still names the older plan tiers, so check the current plan names on Xero's pricing page. Xero's AU plan page says most banks connect through a secure direct feed for daily updates (Xero AU plans). The offshore person reconciles the feed and never needs the client's internet banking login.
Lodgement and the ATO
Lodgement stays with your registered agent. The offshore team prepares, your firm reviews and lodges. Xero Tax, for example, lodges BAS and returns through a tax agent profile connected to the ATO, and is free for Xero partner program members (Xero Tax). Software that talks to ATO systems has to meet the ATO's DSP Operational Security Framework, a minimum level of security requirements for digital service providers (ATO software developers). The big vendors have cleared that bar. Your own logins and roles are what you still have to get right.
Passwords, access control and offboarding
Sharing one login between an onshore reviewer and an offshore preparer breaks the audit trail and, in Xero's case, breaks the MFA rule. Give every person their own login in every tool, keep MFA on, and if a tool has no per-user login, keep it out of the stack. Then offboarding is a checklist:
- A list of every tool the person has a login for, kept from day one, including Hubdoc and Dext, which keep their own user lists.
- Access removed in each tool on their last day. MYOB has a remove user access action. Xero access is per organisation, so remove it from each file.
The rest of the access checklist is in security questions to ask an offshore accounting provider. Client questions belong in the practice system, logged against the job; Karbon connects email to the work item for this reason. A question answered on a personal WhatsApp account leaves no trail.
A worked example with one bookkeeper and 15 clients
Say you hire one offshore bookkeeper for bank reconciliations and payables across 15 Xero clients. On day one they get one Xero login invited into 15 organisations, with MFA on before they open a file. They get one practice management login with a job per client and due dates, on a Restricted or equivalent role if the tool has one. Hubdoc on each file, and a document cabinet holding those clients only. Three or four logins, each of which you can switch off in a minute.
From week two, your review has numbers: time per job from the practice tool, corrections per file from your reviewer, and who posted what from the ledger's change history. If reconciliations take longer in week four than in week two, you'll see it before the BAS deadline does. This is how we run our own teams: named logins inside the client's own software, and a co-founder joins your weekly review (see how we work). If the Xero side is what you're setting up first, read how to onboard an offshore bookkeeper in Xero.
Questions
Is MFA mandatory in Xero?
Yes. Everyone logging in with access to an organisation needs MFA enabled, and the only exception Xero names is payroll-only employees who never log in (Xero MFA FAQ).
What if one client is on MYOB and the rest are on Xero?
Treat it as one more login with the same rules. In MYOB, only an Owner, Advisor or Online admin can add or remove users. Roles are set at invite, so give the bookkeeper the Banking role for that file and nothing more (MYOB manage users).
Next step
If you're putting a stack like this together before an offshore hire, book a call with me. Bring the tools you're on today and we'll go through what to turn on in each before anyone overseas logs in. You can also read how our outsourced bookkeeping service, the Offshore finance desk, works inside your software.