Security Policy

A written plan, not good intentions

A tax practice is a financial institution under the Gramm-Leach-Bliley Act, which means the FTC Safeguards Rule applies to us and a written information security plan is mandatory, not a nice-to-have. Ours is maintained to IRS Publication 4557 and reviewed as the practice changes.

It names who is responsible, what data we hold, where it lives, who can reach it, and what happens if something goes wrong. We would rather point at a document than a promise.

How your documents are protected

• Everything we exchange moves through our own client portal — never email attachments
• Two-factor authentication is required at every login, for us as well as for you
• Files are encrypted with AES-256-GCM at rest and over TLS in transit
• Messages run through encrypted portal messaging rather than sitting in an email thread
• The portal is ours. Your records are not parked in a third-party document service whose security is somebody else’s decision

Access is granted, not assumed

Downloads stay off by default on every file — including the ones you upload yourself. You always see the full index of what we hold for you, and we open a specific file when you need it.

This is deliberate, and it is the part most firms do not do. If an account is ever compromised, what the intruder gets is a list of filenames rather than the contents of your return. It costs a little friction and removes an entire category of loss.

What we ask of you

Security is not one-sided. Use a password you use nowhere else, keep your second factor to yourself, and tell us straight away if you think someone has reached your account.

If you notice anything that looks wrong — a message you did not expect, a file you do not recognise, a login you cannot place — email us and we will look at it the same day. We would far rather chase a false alarm than hear about a real one late.