Your clients' data stays under your control.
Firms that prepare tax returns must keep a written information security plan (WISP) under the FTC Safeguards Rule. We work inside yours, and we put every commitment below in writing.
The rules we work under
Your obligations become ours.
Your firm answers for every client record we touch. So we work under the same rules you do.
- 01IRC §7216Tax return information is used only for the work you authorize, as your service provider, and never for anything else.
- 02AICPA confidential client information ruleClient information stays confidential under the same standard your engagement letters promise.
- 03FTC Safeguards RuleEvery system we build fits inside your written information security plan.
Who does what
Automation prepares. Your accountants decide.
| Automation prepares | Your accountants decide |
|---|---|
| Reconciliation matches and flagged exceptions | Whether the books are right |
| Organized source documents and pre-filled returns | Every tax position and every filing |
| Draft client reports and status updates | What gets said to the client |
| Invoices, reminders and WIP alerts | Write-downs, discounts and when to call a client |
During the audit
A conversation first. A login only if we need one.
- 01The first call is a conversation about your numbers. We don't ask for documents or system access on it.
- 02We sign your NDA before you share any documents.
- 03We ask to see a system only if a large figure depends on it. Access is read-only, limited to that system, and your choice. A screen share works instead.
- 04We don't change anything in your systems during the audit.
- 05If we don't go on to work together, we delete everything you shared within 30 days.
During the build
Access is agreed in writing and tracked.
- 01We agree on exactly which systems we can access, and at what level, before any work starts.
- 02Credentials are stored in a secure vault, with a record of who can reach each system.
- 03Any audit-phase access we no longer need is revoked.
- 04Every system is tested in a separate staging environment before it touches production.
- 05When an engagement ends, every credential and access point is revoked.
In production
Automation prepares. Your people sign off.
- 01Work that needs professional judgment goes to a reviewer on your team before it's final.
- 02Every automated action is logged in an audit trail.
- 03We name every AI provider we use before your data reaches it, and none of them train on your data.
Questions from IT and compliance
For whoever reviews vendors at your firm.
Do you have a SOC 2 report?
Not today. We'll complete your vendor security questionnaire and work within your WISP.
Will you sign our NDA?
Yes, before you share any documents.
Do AI providers train on our clients' data?
No. We use providers whose business terms exclude training on customer data, and we name each one.
Who do we contact with security questions?
See where your firm's hours go.
The audit is free, and you keep the report whether or not you hire us.