Written Information Security Plan
How we protect taxpayer data.
Tax preparers are covered by the FTC Safeguards Rule (16 CFR Part 314). This page summarizes our written plan, element by element. It does not replace each partner firm's own plan.
1 · Responsibility
One named person owns the plan.
The rule requires a Qualified Individual who oversees the program and reports to leadership in writing at least once a year.
TODO: HUMAN INPUT REQUIRED — TODO: HUMAN INPUT REQUIRED — name and title of the Qualified Individual.
2 · Risk assessment
We write down what could go wrong.
A written risk assessment covers where taxpayer data lives, who can reach it, and how each risk is controlled. It is repeated at least yearly and whenever the platform changes materially.
TODO: HUMAN INPUT REQUIRED — TODO: HUMAN INPUT REQUIRED — date of the first completed risk assessment.
3 · Safeguards
What's in place, and what's next.
Access is limited to the people who need itIn place
Each taxpayer sees only their own return. Each firm sees only its own clients. These limits are enforced on our servers for every request, not only in the screens.
Private document storageIn place
Uploaded tax documents sit in private storage. Download links are issued only after an access check and expire in about a minute.
Tamper-evident consent recordsIn place
Every signed consent stores the exact wording, its version, a fingerprint of the text, the time, IP address and device. Signed records can't be edited.
Credentials stay on our serversIn place
Connection keys and service credentials live in encrypted server storage only. Bank and bookkeeping logins are never seen or stored by us.
Share links that expireIn place
Read-only share links are stored as one-way fingerprints, expire, and can be revoked at any time.
Multi-factor sign-in for firm and admin staffPlanned
Staff who can see client data will be required to use a second sign-in factor.
Encryption of the most sensitive fieldsPlanned
Taxpayer ID numbers and account data will be encrypted field by field, masked everywhere, and revealed only through a logged action.
Full activity logPlanned
Every view of client data, consent, CPA approval and export will be logged and searchable by administrators.
Retention and disposalPlanned
Each firm will set how long records are kept. Data is securely disposed of no later than two years after last use unless law or business need requires longer.
4 · Testing and training
Checked regularly, not once.
The rule calls for continuous monitoring or yearly penetration tests plus vulnerability scans every six months, and security training for everyone with access. Automated security scans run on the platform today.
TODO: HUMAN INPUT REQUIRED — TODO: HUMAN INPUT REQUIRED — penetration-test vendor, schedule and staff training cadence.
5 · Service providers
Vendors are held to the same standard.
Hosting, data and connection providers are chosen for their security practices, bound by contract to protect data, and reviewed periodically.
6 · Incidents
If something goes wrong, we say so.
A written incident response plan sets roles, containment steps and notice. A breach affecting 500 or more people is reported to the FTC within 30 days of discovery, and affected firms and taxpayers are told as required by law.
TODO: HUMAN INPUT REQUIRED — TODO: HUMAN INPUT REQUIRED — incident contact email and phone.