Why we keep a written plan
The FTC Safeguards Rule (16 CFR Part 314), issued under the Gramm-Leach-Bliley Act, requires tax preparers to maintain a written information security program. IRS Publication 4557, Safeguarding Taxpayer Data, and IRS Publication 5708 describe how tax professionals should build one.
Our plan follows that framework. It covers this platform, our tax preparation software, and the people and service providers who handle client information.
A qualified individual in charge
A designated qualified individual oversees the plan, coordinates its safeguards and reports on the program in writing to the owner of the practice at least once a year.
Risk assessment
We keep a written assessment of the foreseeable risks to client information, covering how it is collected, stored, accessed, shared and disposed of. We revisit it when our systems or operations change.
Access controls
- Staff receive only the access their role requires; preparers see only the clients assigned to them.
- Access is reviewed periodically and removed promptly when someone leaves.
- Client and applicant documents open only through short-lived signed links, and every staff view and download is logged.
Encryption
Client information is encrypted in transit and at rest. Tax documents are never sent by email; they are exchanged only inside the secure client portal.
Multi-factor authentication
Every staff member must use multi-factor authentication to reach client information. Portal and console sessions end after 30 minutes of inactivity.
Data minimization and disposal
We collect only what we need; the portal has no field for Social Security numbers. Information we no longer need is disposed of securely, generally no later than two years after it was last used, unless the law or a legitimate business need requires us to keep it longer. Applicant information is deleted or anonymized two years after application unless the applicant is hired.
Monitoring and testing
We log access to client information and watch for unusual activity. The plan provides for regular testing of our safeguards through continuous monitoring, or through periodic vulnerability assessments and penetration testing, as the Safeguards Rule describes.
Training
Everyone who works with client information receives security awareness training when they join and at least once a year after that, and acknowledges this plan during onboarding.
Service provider oversight
We choose service providers that can maintain appropriate safeguards, require those safeguards in our contracts with them, and review them periodically.
Incident response
A written incident response plan sets out how we contain, investigate and recover from a security event, and whom we notify:
- affected clients and state authorities, as state law requires;
- the IRS, through its stakeholder liaison process for tax professionals, when taxpayer data is stolen;
- the Federal Trade Commission, within 30 days of discovering an event that involves the unencrypted information of 500 or more people.
Annual review
The plan is reviewed at least once a year, and whenever our operations, our systems or the risks we face change materially.
What this summary is not
This page summarizes our program. It is not the plan itself, an audit report or a certification, and we do not claim certification under any third-party security standard.
Reporting a concern
If you believe your information or our platform has been compromised, contact us right away at aeternumtaxllc@gmail.com or (619) 385-4324.