Privacy notice
This describes the JC Abacus client portal at portal.jcabacus.com — what it holds, who can reach it, and when it is deleted. It covers the portal only, not the wider engagement between JC & Associates and its clients.
Last updated 14 September 2026.
Who is responsible
JC & Associates operates this portal for the firms it works with. Questions, and any request under the headings below, go to admin@jcandassoc.com.
What the portal holds
- Account details — name, work e-mail address, the firm you belong to, and your role in the portal. Accounts are created by JC & Associates; you cannot sign yourself up.
- Sign-in records — when you signed in, by which method, and whether it succeeded.
- Job records — what was requested, for which client entity and period, the deadline, and the messages and notes people write on the job.
- Documents you attach — the files themselves, their names, sizes and checksums.
- An access log — who opened which job and who downloaded which file, including attempts that were refused. This is kept deliberately and cannot be edited or deleted from within the portal, including by an administrator.
The portal asks for no more than this. It does not track you across other websites, and it contains no advertising or analytics trackers.
Identifying numbers
Attachments are not the place for social security, resident registration, taxpayer identification or similar numbers. Before a file can be uploaded the sender must confirm it carries none, and the portal warns when a file name suggests otherwise. Documents containing such numbers stay in your own system and are referenced by link.
The check reads the file name and nothing else. Reading inside a scanned document would require sending it to an outside text-recognition service, which is the thing these rules exist to avoid.
Where it is held, and by whom
JC & Associates uses the following providers. No one else receives portal data.
- Supabase — the database and the file store, hosted in Singapore.
- Vercel — runs the application; its server functions for this portal are pinned to Singapore.
- Resend — sends notification e-mail. Notification e-mail never carries job content — only a reference and a link back to the portal.
- Google Workspace — holds the long-term archive described below, on JC & Associates’ own Google domain.
Work on your jobs is carried out by the JC Abacus team in Vietnam. That is a cross-border transfer, and it is the reason for the access limits set out next.
Who can see what
- A person sees only their own firm’s jobs. This is enforced by the database itself, not only by the screens.
- The JC Abacus processing team sees the jobs it is doing the work on.
- Downloads are never served from a public address. Each one is a link that expires within a minute and a half, issued only after the portal has checked who is asking, and recorded in the access log at the moment it is issued.
How long files are kept
- After a job is delivered, your firm can download its attachments for 30 days.
- The JC Abacus processing team can download them for 7 days after delivery. The team’s need for a client’s source documents ends when the job does.
- At the end of the 30 days the portal copy is removed and the files live only in the JC & Associates archive, which the processing team has no access to at any level.
- The record of a job — what was requested, what was signed off, and by whom — is kept after the files go. Deleting the record would defeat the purpose of having one.
Deletion on request
A client firm may ask for its files to be deleted. We remove them from the portal and from the archive, and record what was deleted, when, at whose request and who carried it out — so that you can show your own client the same.
The access log is the one thing a deletion request does not reach. It records that a file existed and who opened it, not the file. Deleting the evidence of access along with the data would defeat the purpose of both.
Signing in
There are no passwords. JC office staff sign in with their work Google account; partner firms receive a one-time link by e-mail, and that link alone is not enough — it must be opened in the browser that asked for it, or confirmed with a code shown only on that screen and never sent in the e-mail.
The portal sets one cookie, which identifies your session. It is not used for tracking. Sessions end after a period of inactivity and, in every case, within twelve hours.
Changes
The figures above are the ones the portal enforces. If they change, this page changes with them.