Your accounts are the most complete picture of your business that exists — every customer, every supplier, every salary, every bank feed. We looked inside twenty-one accounting packages sold to UK businesses to ask where that picture actually lives, and who controls it. Even Britain’s own accounting champion gave a surprising answer.
Accounting software is different from every other purchase in one respect: for most UK businesses it stopped being optional. Making Tax Digital obliges VAT-registered businesses to keep digital records and file through software, and the same regime is now extending to income tax. The government, quite reasonably, pushed the country’s books into software — but nobody in that process asked, or told you, where the books would physically end up.
So we asked, the same way we did for CRM systems: twenty-one products — American, British, Irish, Dutch, Norwegian, German, Canadian, Indian and one with no owner at all — traced through their own published documents. Who owns the company; who the product is built for; where a UK customer’s data is stored; whose computers it runs on; and whose artificial intelligence now reads the ledger.
The headline finding is an uncomfortable one for anyone who buys British by reflex: owning the vendor and holding the data have almost nothing to do with each other.
Britain’s champion keeps the data elsewhere
Sage is the great British software success story — Newcastle-built, FTSE-listed, the default name in UK accounting for forty years. It is genuinely UK-owned; no other vendor on our list at its scale is. And yet: Sage Intacct, the product Sage sells to mid-market UK companies, runs on Amazon’s cloud and stores UK customers’ data in the EU, not the UK — Sage’s own privacy policy says so. Sage’s new AI assistant is built on Amazon Bedrock, an American AI platform. Meanwhile the unfashionable old Sage 50 — the desktop product the industry has spent a decade migrating customers away from — keeps its core data on your own computer, which is, ironically, the strongest data-location position in the entire mainstream market.
Xero tells the same story from the other direction. New Zealand-owned, beloved of UK small businesses and accountants — and its servers are in the United States, on Amazon, with OpenAI on its supplier list and a new AI partnership with Anthropic. The UK’s two favourite small-business bookkeeping brands keep the books in the EU and America respectively.
Now the reversal. QuickBooks — as American as software gets — tells UK customers their data is held “in your home country” on Intuit-run systems (with a privacy-statement caveat reserving some US processing). Oracle’s NetSuite operates actual UK data centres in London and Newport. Microsoft’s Business Central offers a UK data region as standard. Just as with CRM, the American giants are often better at keeping data in Britain than the British and Commonwealth brands are — because they can afford to build everywhere, and the smaller vendors rent whatever cloud region is cheapest.
The twenty-one, at a glance
| Product | Owned from | Aimed at | UK data lives | Runs on | AI inside |
|---|---|---|---|---|---|
| QuickBooks Online [1] | USA (listed) | Sole traders & SMEs | UK (“your home country”, with caveats) | Intuit-run AWS | Intuit’s own + OpenAI |
| Dynamics 365 Business Central [2] | USA (listed) | Small & mid-size | UK region | Microsoft end-to-end | Microsoft |
| NetSuite (Oracle) [3] | USA (listed) | Mid-market to enterprise | UK data centres (London, Newport) | Oracle’s own cloud | Oracle’s own |
| Sage 50 Accounts [4] | UK (listed) | Small businesses | Your own computer (cloud add-ons: Azure/AWS) | Desktop + Azure/AWS components | Sage AI on Amazon Bedrock |
| Sage Intacct [4] | UK (listed) | Mid-market | EU, not UK | Amazon | Sage AI on Amazon Bedrock |
| Xero [5] | New Zealand (listed) | Small businesses | USA | Amazon | OpenAI; Anthropic partnership |
| FreeAgent [6] | UK (NatWest-owned) | Freelancers & micro | Ireland | Amazon | In-house only |
| IRIS Elements [7] | UK (private equity) | Practices & small business | Not disclosed | AWS in stack; AI on Microsoft (UK-processed, stated) | Microsoft-based |
| KashFlow (IRIS) [7] | UK (private equity) | Small businesses | UK (Rackspace London)* | Rackspace | — |
| Crunch [8] | UK (founder + accountancy firm stake) | Freelancers & small ltd cos | Not disclosed | Not disclosed | Not disclosed |
| Clear Books [9] | UK (family-owned) | Small businesses | EU | Amazon | — |
| Pandle [10] | UK (founder-owned) | Micro & small | UK (Google’s UK data centres) | — | |
| iplicit [11] | UK (founder-led + minority investor) | Mid-market | UK available | Microsoft Azure | — |
| AccountsIQ [12] | Ireland (VC-backed) | Mid-market | Region not disclosed | Microsoft Azure | — |
| Exact Online [13] | Netherlands brand, US private equity | SMEs | Frankfurt, on Amazon | Amazon | Not disclosed |
| Silverfin (Visma) [14] | Norway group, UK-led PE owners; London IPO pending | Accountancy firms | Not disclosed | Not disclosed | |
| Twinfield (Wolters Kluwer) [15] | Netherlands (listed) | All sizes | “Europe” — no UK option | Not disclosed | Not disclosed |
| FreshBooks [16] | Canada (VC-backed) | Freelancers & SMEs | US/EU — no UK | Amazon + Google | Not disclosed |
| Zoho Books [17] | India (family-owned) | Small businesses | Netherlands + Ireland (UK site announced, not yet live) | Zoho’s own servers | Zoho’s own |
| ERPNext (Frappe) [18] | India (founder-owned) | SMEs & mid-market | Your choice — self-host, or its cloud’s London region | Self-host: yours. Cloud: AWS | n/a |
| GnuCash [19] | Nobody — community project, no company | Individuals & micro | Your own computer | Your own computer | n/a |
*KashFlow’s UK-hosting statement is from older documentation — re-verify before relying on it.
Size changes everything — but differently this time
In CRM, large UK enterprises had essentially no UK-owned option. Accounting is kinder to Britain in ownership terms: Sage covers small to mid-market, IRIS and iplicit serve practices and mid-market companies, and a clutch of founder-owned UK firms (Pandle, Clear Books, Crunch) serve the small end. The catch is that UK ownership buys you less than you’d think: of the UK-owned vendors, only Pandle (Google’s UK data centres), iplicit (UK Azure region) and the KashFlow legacy estate clearly keep data in Britain — Sage Intacct’s is in the EU, FreeAgent’s in Ireland, Clear Books’ in the EU, and IRIS and Crunch don’t say. The sharpest contrast in the whole table is German: DATEV [20], the accounting platform owned cooperatively by the accountants who use it — an ownership model with no investor to sell to — which we verified but excluded from the table for one reason: it isn’t sold in the UK. The most sovereignty-friendly ownership structure in European accounting software simply never crossed the Channel.
Two ironies worth sitting with
The retired technology was the sovereign one. Desktop accounting — Sage 50, GnuCash, the much-mocked “old way” — keeps the ledger on your own machine, under your own lock. The cloud migration that the industry (and, indirectly, Making Tax Digital) drove was also a migration of every UK ledger onto rented, mostly American, infrastructure. Nobody decided that; it happened as a side-effect. GnuCash remains the purest case in our whole research programme: free, open-source, runs entirely on your own computer, and owned by no one — there is no company to be acquired, repriced, or compelled.
The AI is reading the books now. Sage’s assistant runs on Amazon’s AI platform; Xero lists OpenAI as a supplier and has partnered with Anthropic; Intuit blends its own models with OpenAI. Accounting data is the most sensitive feed yet offered to these systems — and as with CRM, the AI layer is the least disclosed layer in every vendor’s documentation.
And the licence trap repeats. Of the open-source candidates we checked, ERPNext is the real thing (fully open licence, Indian founder-owned steward, and its hosted cloud even offers a London region); GnuCash is the real thing; but Akaunting — marketed as open source — turns out to ship under a restricted licence that caps production use at two users until each version ages four years, and Manager.io’s “free” desktop product is freeware, not open source. Read the licence, not the homepage.
What a UK buyer can actually do
The same six questions as for CRM apply — who ultimately owns you; where exactly is my data and can I choose; whose cloud is underneath; whose AI reads my data and can I switch it off; who else touches it; what happens if you’re sold. For accounting, add a seventh: “If I leave, how do I get seven years of records out?” — HMRC expects you to keep them, and export is where cloud accounting lock-in really bites.
And the dial works the same way. Take the default with your eyes open (QuickBooks, with its home-country statement, is better than its reputation here). Pin the data down where a UK region exists (Business Central, NetSuite, iplicit). Prefer UK-owned and UK-hosted at the small end (Pandle is the quiet champion). Or run it yourself (ERPNext self-hosted; GnuCash for the smallest businesses) and accept the homework. What you can no longer do — and Sage Intacct is the proof — is assume that buying from a British company keeps British books in Britain.
Sources
All facts are taken from each vendor’s own published documentation (privacy, security, data-location and sub-processor pages) and from company registries, read directly during June 2026. One reference per vendor; where a vendor discloses no hosting or data location, only the ownership source is listed.
- Intuit (QuickBooks) — SEC filings: https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0000896878&type=10-K ; data/privacy: https://quickbooks.intuit.com/learn-support/en-uk/help-article/banking/privacy-security-quickbooks/L7q2gUqfM_GB_en_GB ; AI: https://investors.intuit.com/news-events/press-releases/detail/1284/
- Microsoft (Business Central) — SEC 10-K: https://www.sec.gov/Archives/edgar/data/789019/000095017025100235/msft-20250630.htm ; service/data region: https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/service-overview ; https://learn.microsoft.com/en-us/microsoft-365/enterprise/m365-dr-overview
- Oracle (NetSuite) — SEC 10-K: https://www.sec.gov/Archives/edgar/data/1341439/000095017025087926/orcl-20250531.htm ; infrastructure: https://www.netsuite.com/portal/platform/infrastructure.shtml
- Sage (Sage 50, Sage Intacct) — Companies House: https://find-and-update.company-information.service.gov.uk/company/02231246 ; sub-processors/data: https://www.sage.com/en-gb/-/media/images/sagedotcom/master/global/feature/pdf/legal/sages-sub-processors.pdf ; AI/AWS: https://press.aboutamazon.com/aws/2026/4/sage-deepens-collaboration-with-aws-to-fast-track-agentic-ai-for-small-and-mid-sized-businesses
- Xero — NZ FMA: https://www.fma.govt.nz/business/legislation/secondary-legislation/exemptions/financial-markets-conduct-xero-limited-exemption-notice-2025/ ; GDPR/data: https://www.xero.com/uk/data/xero-and-gdpr/ ; sub-processors: https://www.xero.com/uk/legal/xero-subprocessors/
- FreeAgent — NatWest ownership: https://www.natwestgroup.com/who-we-are/our-brands/freeagent.html ; security: https://www.freeagent.com/us/features/security/
- IRIS (IRIS Elements, KashFlow) — ownership: https://www.iris.co.uk/news/iris-software-group-secures-major-us-investment-from-leonard-green-partners/ ; IRIS Elements security: https://www.iris.co.uk/blog/accountancy/how-iris-elements-cloud-accounting-software-delivers-the-security-you-need/ ; KashFlow data location: https://www.kashflow.com/about/faqs/where-is-all-my-data-physically-kept/
- Crunch — Companies House PSC: https://find-and-update.company-information.service.gov.uk/company/06014477/persons-with-significant-control
- Clear Books — Companies House PSC: https://find-and-update.company-information.service.gov.uk/company/06636109/persons-with-significant-control ; security: https://www.clearbooks.co.uk/terms/security/
- Pandle — Companies House PSC: https://find-and-update.company-information.service.gov.uk/company/07083629/persons-with-significant-control ; data location: https://support.pandle.com/en/articles/2033623-how-secure-is-pandle-how-safe-is-my-data-and-where-is-it-kept
- iplicit — Companies House: https://find-and-update.company-information.service.gov.uk/company/03207522 ; G-Cloud listing: https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/693404684326001
- AccountsIQ — Companies House PSC: https://find-and-update.company-information.service.gov.uk/company/06578522/persons-with-significant-control ; trust centre: https://www.accountsiq.com/trust-centre/security-measures-overview/
- Exact (Exact Online) — ownership (Apax→KKR): https://www.apax.com/news-views/kkr-to-acquire-exact-software-from-funds-advised-by-apax-partners/ ; sub-processors: https://www.exact.com/trust/privacy/sub-processors-business-data
- Visma (Silverfin) — ownership: https://www.cityam.com/visma-hesitation-tests-londons-ipo-revival/ ; Silverfin security: https://silverfin.com/security/
- Wolters Kluwer (Twinfield) — annual report (Euronext): https://live.euronext.com/en/products/equities/company-news/2026-03-11-wolters-kluwer-publishes-2025-annual-report
- FreshBooks — terms/ownership: https://www.freshbooks.com/policies/terms-of-service ; sub-processors: https://www.freshbooks.com/third-party-sub-processors
- Zoho (Zoho Books) — Companies House PSC: https://find-and-update.company-information.service.gov.uk/company/13424508/persons-with-significant-control ; data centres: https://help.zoho.com/portal/en/kb/accounts/manage-your-zoho-account/articles/data-center-for-zoho-account ; privacy: https://www.zoho.com/privacy-commitment.html
- Frappe (ERPNext) — ownership: https://frappe.io/blog/announcements/frappe-zerodha ; cloud servers/region: https://frappe.io/cloud/servers
- GnuCash — community project (no company): https://www.gnucash.org/donate.phtml
- DATEV — cooperative company structure: https://www.datev.com/about-datev/company-structure
Research notes: all facts taken from vendors’ own published documentation — privacy policies, data-location and security pages, supplier lists — and from company registries, read directly during June 2026. Data locations and supplier lists change; check the vendor’s current documents before relying on them. This article reflects the opinions of the Information Matters team — human and AI — and should not be considered statements of fact. Please feel free to contact us if you would to suggest any corrections.
