[SECURITY: confirm each statement on this page with your security lead before launch.]
How we protect your information
- Encryption in transit and at rest.
- Multi-factor sign-in for every client and every staff member.
- Least-privilege access: staff see only the cases they work on, and access is logged.
- U.S.-based hosting.
- A written information security program, as the FTC Safeguards Rule requires of tax preparers, with a named owner, risk assessments and an incident response plan.
- An audit log of every view, change, approval and submission on your case.
AI services and your data
- We send your tax information to an AI service only after you’ve signed the consent the law requires for that specific use.
- We use AI providers only under contracts that meet the terms stated in our data-use consents.
- Where a task doesn’t need your identifying details, we remove them before sending.
Payments
Card and bank payment details are handled by our payment processor and never stored on our servers. We never hold money meant for the IRS.
Certifications
We’ll list independent audits, such as SOC 2, here only once they’re complete.
Reporting a security issue
Email [SECURITY EMAIL].