Security & Compliance
Your Clients' Data Is Protected by Controls You Can Verify
These are the exact security protocols we run for our own CPA firm, and we put the exact same ones in place for yours.
Core security controls
Eleven controls on every placement
Security Control
Summary Description
Company-managed devices
Issued and managed devices with encrypted drives and blocked USB storage.
Multi-factor authentication
Enforced across email, candidate portal, and all client systems.
Endpoint protection
Managed antivirus/EDR, automatic patching, and remote lock/wipe capabilities.
Least-privilege access
Access limited to required client systems and revoked the same day staff leave.
Data handling protocols
Client files stay in your systems. Nothing is saved on local drives or personal accounts.
Secure remote work
Approved setups over encrypted VPN with strict clean-desk policies.
Activity monitoring
Logins and access are logged, providing clear audit trails for your firm.
Background checks
Comprehensive identity, education, employment, and criminal checks before placement.
Confidentiality agreements
Signed NDAs covering your firm and all client information.
AI & data-use policy
Client data is never entered into personal or unapproved AI accounts.
Client-specific controls
We align with your firm’s WISP, software restrictions, and review workflows.
Regulatory compliance
IRC §7216 & Regulatory Compliance
IRC §7216 Support
Standardized consent templates and electronic signature workflow guidance.
FTC Safeguards & WISP
End-to-end alignment with your Written Information Security Plan.
SOC 2 & ISO Standards
Operational controls structured around industry-standard security frameworks.