A preparer has access to forty client returns. Over a slow week, the account quietly exports thirty-nine of them. Nothing breaks. No login looks odd. The credential is real, the access was granted on purpose, the path was approved. By the time anyone notices, the returns are gone and the only record is a log nobody read in time.
That is how client financial data actually leaves an accounting platform. Not through a broken control. Through a permitted one, used at a volume and a cadence that no longer match the work.
The platform holds the most consequential data a business owns. Returns, ledgers, payroll runs, bank reconciliations. And the data does not sit still, because moving it is the product. A partner reviews across a dozen engagements. A bookkeeping integration syncs transactions overnight. An e-file connector ships the return to the IRS. Every one of those moves is permitted. That is exactly why the exposure is hard to see.
Access is not the threat
Accountingtech security thinking starts with access. Who can log in, what role they hold, which clients they can open. Platforms have poured real work into it: SSO, role-based permissions, audit logs, SOC 2 attestation. A serious accounting platform in 2026 has access well covered.
But access is permission. Permission is not the threat. The threat is the shape of movement across actions that were each allowed on their own.
Watch where client data exits. An integration token, scoped correctly on day one, now reads more than it ever read before. A partner account, real and authenticated, suddenly pulls bulk data from clients it has never touched. No rule is violated. The breach is the pattern, not any move inside it.
The audit log records the timeline you hand to the disclosure letter
Accounting platforms log heavily, and the log earns its keep after an incident. It tells you who opened what and when. But a log writes actions one at a time, as discrete entries. It never resolves a run of moves to a behaving identity and asks whether the behavior fits.
A preparer exporting one client's return is a normal entry. The same preparer exporting that client every day for a quarter is a string of normal entries. The log holds both and judges neither. What it cannot do is decide, while the second pattern is forming, that something is wrong. By the time anyone reads it closely, the data is already gone, and what you are reading is the timeline you hand to the disclosure letter.
Teams reach for two fixes. Predictive controls guess in advance which moves are dangerous, flag a flood of permitted-but-unusual actions, and bury reviewers while the slow, patient exfiltration slides through looking like ordinary work. Forensic review is accurate, and late. The accurate answer arrives after the data leaves; the fast answer is wrong.
Govern the movement while it moves
There is one place the pattern is visible in time to act on it: the movement itself, at runtime, while the data is in motion.
Hilt is runtime Data Movement Governance. One lightweight collector watches data movement at the kernel, metadata only by default, off the path. It runs single-tenant inside your own cloud, on the order of 0.1% of one core and 4 to 8 MB of memory per host. It never sits inline. It does not stand between client data and its destination, and it does not block, drop, or alter traffic. It watches the move instead of getting in its way.
Each move resolves to a probabilistic, source-dependent identity: which user or service, which job behind the move, which destination, and whether this fits how that identity normally handles client financials. When a preparer's account starts bulk-reading returns it can reach but rarely touches, at an hour and a volume that break from months of its own history, the deviation lights up across layers at once. The job is off. The access pattern is a bulk read of high-value paths in a short window. The volume out is high for an approved channel. One signal is noise. The signals together are a case, not an alert.
Your bank already works this way with money. It flags the charge that does not fit how you spend, without knowing what you bought. Hilt flags the data behind every filing the same way. It does not read the return to see the movement is wrong.
Metadata first, content available
A CISO at an accounting platform raises privacy on the first call. Client financial data is about as sensitive as data gets, and a security layer that reads it is part of the problem.
It does not have to read it. Metadata-only is the default vantage. Hilt sees that a pattern of movement is anomalous without inspecting any filing, ledger, or return. Content-aware inspection is there when an investigation calls for it, never as the price of admission and never as the default. You get the behavioral signal without handing your security tooling the exact data you are guarding.
That is what makes the model fit accountingtech. Clients trust the platform with their financial truth. A governance layer that had to read all of it to protect any of it would cancel itself out. Watching movement instead of content settles the contradiction.
What it adds to the stack you run today
Hilt does not replace the controls an accounting platform already runs. SSO, role-based access, and audit logging do what they were built for: govern who gets in, record what they did. Hilt covers the layer they were never built for, how data moves once access is granted, and surfaces the dangerous pattern across permitted moves while there is still time to act.
When the pattern forms, Hilt writes the case with the identity, the job, the path, and why the movement is unusual. It responds with host-level network isolation, quarantine from the control plane, never by filtering traffic inline. The events never leave your account.
For a platform whose value rests entirely on being trusted with client financials, the question was never whether each move was allowed. You already know it was. The question is whether you can see, as it happens, the moment the pattern of permitted moves stops looking like the work and starts looking like a breach.
If your stack cannot answer what this preparer's data actually did this week, resolved to the job behind it and scored against how it normally moves, that is the gap. We will walk an engineer through exactly how the collector sees it, in thirty minutes, in your own terms.