Security
This page is written for the person handing over a return, not for a developer. It describes what we do today with the client portal and where we are still building.
Documents are encrypted in transit and at rest. What that means, in plain terms, is that when a file leaves your computer and travels to the portal, it is scrambled during the trip. It stays scrambled on our side until an authorized person opens it.
Access is limited to your preparer and the reviewing accountant. Other members of the firm cannot open your file without a specific reason recorded in the log. Nobody outside the firm has access.
Every document action is logged. That includes every open, every download, and every signature, with a timestamp. If you ever need to know who touched a file and when, that record exists.
If you cannot get into your account, we recover it by verifying who you are through the office, not through a self-service form. The exact recovery process is being finalized with the firm before the portal opens to clients.
Being finalized. Recovery process is being written up with the firm. Placeholder pending A12 and B12.
We do not sell or share your data with third parties. We do not send tax documents as email attachments. We do not use fear-of-the-IRS language to sell services, and we do not promise a specific refund outcome. Those things are not what this practice is.
This block is deliberately in the open. A short, honest list of items still being finalized with the firm before the portal is ready for clients:
A written information security plan (WISP)Pending
Required of paid tax preparers under the FTC Safeguards Rule. Being scoped with the firm.
Document retention period and destruction schedulePending
Being confirmed with the firm.
Backup and account recovery proceduresPending
Being written up ahead of the portal launch.
Formal breach-response and client-notification processPending
Being drafted alongside the WISP.