Legal
Security & confidentiality
We hold financial, payroll and tax records. Here is how we protect them and what we never do with them.
A written information security plan
Any firm holding taxpayer data is required under the FTC Safeguards Rule to maintain a written information security plan. There is no minimum size and no small-firm exemption, and PTIN renewal now requires certifying that one is in place.
We maintain one. It is reviewed at least annually.
What that means in practice
- Multi-factor authentication on every system that touches client data
- Encrypted document exchange through a secure portal, we do not accept sensitive documents by email attachment, and we ask you not to send them that way
- Encryption in transit and at rest
- Access limited to people who need it for your engagement
- Device encryption and endpoint protection on every machine used for client work
- Regular backup, with restoration tested rather than assumed
- Retention and secure destruction on a defined schedule
- An incident response plan, including how and when you would be notified
Your data does not leave the country
IRC §7216; Treas. Reg. §301.7216-3; Rev. Proc. 2013-14
Work is performed in Los Angeles. We do not use offshore preparers or offshore processing.
This is worth understanding generally, not just about us. Where a firm does send tax return information to a preparer outside the United States, federal law requires your prior written consent in a specific prescribed form: including an express warning that US privacy protections may not be enforceable against that offshore preparer.
If you have never signed such a consent and you suspect your work is being done overseas, that is a direct question worth asking your current firm.
On artificial intelligence
We use AI tools for internal drafting and research, as most professional firms now do. We do not put client data into public AI tools, and we do not use AI to make professional judgements.
Every deliverable is reviewed by the person whose name is on it. That is how we work, not a marketing position.
If you think something has gone wrong
If you believe an account has been compromised, or you receive something purporting to come from us that looks wrong, call us directly on the number on this site rather than replying.
Invoice and payment redirection fraud is common in this industry. We will never email you asking to change bank details.