Email without defined controls
Tax files sent by email can fall outside a centralized path for access, traceability, and review.
Security architecture / WISP
Tax-data protection
Security & WISP Compliance
We support responsible tax-data handling with access controls, traceability, and WISP documentation.
A sober framework to share, organize, and protect sensitive information through every stage of the process.
Security posture
01At restAES-256 encryption
02In transitHTTPS / TLS
03TraceabilityActivity logging
The WISP framework
What is a WISP?
A Written Information Security Plan (WISP) documents the controls and procedures a tax practice uses to handle sensitive information responsibly.
Important: A documented WISP helps a tax practice define controls, responsibilities, and response steps for sensitive information.
Control framework
Protect access
Individual credentials and per-user controls.
Maintain traceability
Log relevant activity for review.
Document the response
Keep processes ready for the next step.
Risk signals
Weak points that need attention.
A secure practice begins by identifying how and where tax information is exchanged.
Shared clouds without configuration
A personal or shared folder can lack permissions, activity logging, and documented processes when it is not configured carefully.
No documented WISP
Without a documented plan, it is harder to assign responsibilities and respond consistently to an incident.
Operational controls
Protection layers designed for sensitive information.
Documented controls that support responsible handling of files, access, and security events.
CTRL-01
AES-256 encryption
Files are protected with AES-256 encryption to support secure handling of sensitive information.
CTRL-02
HTTPS/TLS in transit
Every data transfer between your browser and our servers is protected with TLS certificates.
CTRL-03
Activity logging
Relevant upload, download, and access actions are logged to support traceability.
CTRL-04
Access control
Secure authentication with unique credentials per preparer. Only authorized users access documents.
CTRL-05
Clear responsibilities
Documentation helps define who reviews controls and how security events are escalated.
CTRL-06
Incident response
Documented procedures support the response to data incidents and the communication of required next steps.