Trust, with
clarity.

Know what you are sharing.

The public JLC website introduces the firm. JLC Limited Access, at onboarding.jlc.ltd, provides a separate onboarding experience. Opening Access is not the same as submitting documents or opening a client account.

The current guided onboarding page keeps engagement selections in the open page’s memory. Those selections are not submitted to the firm by the guide. Restarting clears them; reloading starts a new guide. This describes the guide’s answers—not all technical data processed to deliver a website.

When you email the firm, the information you choose to include is sent through email services to JLC. Website delivery can also involve technical information such as IP address, browser details and requested pages.

Read the existing firm privacy policy ↗

This Trust Center explains the website and Access experience. It supplements, rather than replaces, the firm’s privacy policy and your engagement terms. Questions about how either applies to your records should be directed to the firm.

How information moves.

Service providers and integrations

GitHub Pages serves the public website. Access is built and hosted through Lovable. Access loads fonts from Google Fonts and includes application error-reporting code; delivery and diagnostic services may therefore process technical request or error information.

The firm’s Microsoft environment is the intended system of record for the document workflow. Separate accounting, financial-data or AI services described in the firm privacy policy are not automatically activated just by following a link to Access. Ask the firm which services apply before sharing sensitive information for a particular engagement.

Clear boundaries.
Measured claims.

Use the HTTPS addresses jlc.ltd and onboarding.jlc.ltd. HTTPS protects the connection in transit; it is not a certification of every application control or a guarantee against all risk.

Microsoft-connected workflow

The Access implementation includes code for Microsoft Entra sign-in, role-based authorization, recipient-bound invitations and SharePoint document handling. Having that code does not establish that tenant permissions, hosting configuration, retention settings or the complete production workflow have been activated and independently verified.

Until your team confirms a working document channel, treat Access as an onboarding guide. A VIP ticket graphic or unique URL is not proof of identity or authorization to access someone else’s records.

What we are not claiming

This page does not assert that JLC Limited or Access holds SOC 2 or ISO certification, that every security control has been independently audited, or that any system is risk-free.

Protect your access

• Keep invitation links private and verify unexpected requests with your JLC contact.
• Never send passwords, verification codes or recovery keys to the firm by email.
• If a link or request seems suspicious, stop and contact the firm using contact details you already know.

The right records.
The right channel.

Your JLC team determines which records are needed for your engagement. The preparation guide is not a request to submit every document it mentions.

Document retention is separate from the browser-only guide. The existing privacy policy describes the firm’s general retention position; applicable engagement terms and record requirements also matter. This page does not create a new retention schedule or promise automatic deletion.

Microsoft-connected document intake requires an approved retention configuration and the appropriate access setup. Ask your team about the storage location, authorized recipients and retention treatment before uploading records.

Talk to the firm.

For privacy questions, requests to access or correct information, deletion inquiries, or a suspected security issue, contact luke@jlc.ltd or call 919.888.5154.

Start with a brief description. Do not include passwords, full account numbers, tax documents or identity documents. The team can arrange an appropriate follow-up channel. Requests may require identity verification, and record obligations may limit deletion.