Situation
An accounting firm in Klaipėda, Lithuania serves about 150 clients, from sole proprietorships to a few mid-sized manufacturing and trading companies. The firm has 25 people, 20 of them accountants. Their main tool is Rivile, an accounting and ERP system widely used in Lithuania, which holds every client’s books, invoices, payroll and the reports to the tax authority and the social security authority.
Rivile ran on an office server installed five years earlier by a local computer technician. After the pandemic most accountants worked from home at least part of the week, connecting through a remote desktop that was open directly to the internet. Passwords were simple, there was no two-factor verification, and the server logs showed thousands of login attempts from foreign addresses every night.
The turning point came when a larger client, preparing for its own audit, asked the firm to show how its accounting data was protected, where backups were made and who had access. The firm’s manager had nothing to show. Backups went to a USB drive that the chief accountant sometimes took home.
What was needed
Together with the manager and the chief accountant we agreed on what was required:
- Rivile has to work from anywhere, but access must be secure only, with personal accounts and a second verification factor.
- No open ports to the internet.
- Daily backups outside the office, with the ability to go back quickly to yesterday’s data, because accountants’ mistakes are usually noticed the next day.
- Documents and reports that can be shown to clients and their auditors.
- A migration without a long interruption, because declarations are filed at the start of the month and the books are closed at the end.
- No more updating and maintaining the office server themselves.
What we did
Week 1: preparation
We reviewed the existing Rivile installation: the version, the number of databases (each client has a separate database, over 150 in total), additional modules and the integrations with banks. We agreed the licence transfer with a Rivile representative. We prepared an ERP hosting environment in our data centre in Lithuania (EU): a server dedicated to this firm alone, with Bitdefender GravityZone protection, monitoring and automatic updates.
We created a personal account for every employee. We removed the shared “accounting” account that several people used, which was one of the more painful changes because a few employees were used to it.
Week 2: VPN, 2FA and a pilot
We deployed a VPN client for all employees with two-factor authentication through a phone app. The hosted Rivile environment is reachable only through VPN, and the remote desktop port on the internet is closed. We connected the office network to the cloud with a permanent VPN tunnel, so work from the office looks the same as before.
Five accountants worked for a week in a pilot environment with a copy of real data. The hardest parts turned out to be the bank statement import integration and the print templates, which had been tailored to the firm’s specific printers. We fixed them in two days.
Week 3: migration and backups
We carried out the migration on the weekend after the monthly declarations. On Friday evening we stopped work on the office server and moved all the databases, and on Monday morning the accountants were already working in the cloud. We left the office server switched off for another month, after which its data was securely erased.
We turned on daily backups: one copy stays in our data centre in Lithuania (EU), a second goes to an Amazon data centre in Germany. The backup history is kept for 30 days, so any client’s database can be restored to its state on any of the last 30 days. This matters most to the accountants: if a mistake is made while closing a month, yesterday’s database for that one client can be restored on its own without touching the others.
We prepared a document pack for client audits: where the data is physically stored, how the connection is encrypted, who has access, how often backups are made and how recovery is tested. The documents are updated every quarter.
Result
In the first year after the migration the firm lost not a single piece of data. This is measured simply: every recovery request is logged, and all seven requests during the year (accountants’ mistakes when closing periods) were completed from yesterday’s backups in under an hour.
All logins to Rivile, 100%, go through VPN with two-factor authentication. The server logs no longer show nightly login attempts from abroad, because there is nothing to attempt: the port does not exist on the internet.
Data recovery granularity is one day: any client’s books can be returned to yesterday’s state and, if needed, to any of the last 30 days. For client auditors the firm now provides the document pack, and the same large client that started it all renewed its contract.
Before, an auditor’s question about backups was unpleasant. Now we send a document and that is it.
What we would advise in a similar situation
- For an accounting firm, backup history matters more than backup frequency. One latest copy will not save you from a mistake you notice three days later.
- Shared accounts in an accounting system are a risk not only to security but to accountability: it is impossible to say who made an entry. Personal accounts are the first step.
- A remote desktop open directly to the internet is the most common entry point for ransomware at small companies. VPN with 2FA is the minimum standard.
- Plan the migration around the accounting calendar, not IT convenience: the weekend after declarations is the best time.
