Security & compliance · for tax practices
What has to be true before the first workflow runs
Your firm handles tax return information. That sets the frame for every automation: who may see what, where data is processed, and who releases the result. This page shows how we build inside that frame.
Get your free AI Check 100% free and done in 2 minutes
The data path
Nothing leaves your firm unreleased
Data comes from your systems, is processed in the region we agreed on, and ends up as a draft for review. Only what a person releases goes out.
01A client uploads a document to your portal or sends it by email. Nothing changes for them.
02The AI reads it, matches it to the request list and drafts what comes next, such as a reminder for what is still missing.
03Someone in your firm looks at the result and releases it with one click. Nothing goes out before that.
04The document is filed where it belongs, the task is updated, and the step is logged with person and time.
- Processing location fixed in writing before the build.
- Service accounts you control, least access per workflow.
- Every release is logged with person, time and data.
The human part
Someone in your firm signs off
The AI reads, sorts and drafts. A person in your firm reads the result and releases it. That is not a setting you can switch off later. It is how every workflow is built.
- Drafts and suggestions land in a review list.
- Each release is logged with person and time.
- Tax judgment stays with your professionals.
The rules
The frame we design for
A plain summary, not legal advice. For each rule: what it asks of your firm, and how our setup answers it.
What it asksTax return preparers may use and disclose tax return information only as the regulations allow. Sending it to a contractor, and in particular to anyone located outside the United States, can require the taxpayer’s consent.
How we build for itWe plan processing in the United States. Our team works from Frankfurt and Los Angeles. We build and test with sample or masked data. Access to live return information from outside the U.S. only happens if your firm has decided it is permitted and has the consents it needs.
What it asksTax and accounting firms need a written information security program, a risk assessment, access controls, and oversight of service providers.
How we build for itWe work as a service provider under a written agreement, with the access controls and logging described above. You receive the documentation of every workflow for your program.
What it asksThe IRS expects every tax professional to have a written information security plan and to keep it current.
How we build for itEach workflow comes with a one-page description you can add to your WISP: purpose, data, systems, access, approvals, and what happens in an incident.
What it asksProfessional rules on confidential client information also apply when you use outside service providers. Responsibility for the work stays with the practitioner.
How we build for itThe AI drafts and prepares. Review, judgment and sign-off stay with your professionals, and every step is traceable.
What it asksState privacy and breach notification laws can apply depending on where your clients live.
How we build for itWe keep data flows small and documented, so your firm can answer quickly what was processed where.
Rules change. Please confirm the current requirements with your counsel or your professional body before relying on this summary.
Clear boundaries
What runs on its own, what needs approval
- Recognizing and filing incoming documents
- Matching uploads against the request list
- Scheduling reminders and follow-ups
- Calculating response dates from notices
- Drafting replies and coding suggestions
- Anything that is sent to a client
- Bookkeeping entries and adjustments
- Anything that is filed or submitted
- Changes to client master data
- Tax advice or professional judgment
- Signing or filing returns
- Decisions about a client relationship
- Moving client data into tools you have not approved
Start today
Your next steps
Take the free AI Check
Seven questions, about two minutes. You see your score and your three biggest levers right away, in your browser.
Today · 2 minutes Start the AI CheckGet your worked-out report
A senior consultant turns your answers into a report: hours per lever, a tool map for your stack, a security checklist and a 90-day plan.
PDF in 2 business days
Walk through it together
Fifteen minutes on the phone with Cedric, at a time that suits you. If there is clear potential, a strategy session follows. If there is not, we tell you.
15 minutes · by phone Or book a call now Get your free AI Check 100% free, instant result in your browser
Your questions answered
Frequently asked questions
No. This page describes how we design and document our work. Whether a specific use is permitted for your firm is a question for you and your counsel. We give you the facts you need to answer it.
It means we take the question seriously before the project starts. We plan processing in the United States and build with sample or masked data. Whether anyone outside the U.S. may see live tax return information, and with which consents, is your firm’s decision. The setup works either way.
Where we agree in writing before we build: a U.S. region or your own tenant. Our German clients are hosted in Europe for the same reason: data stays in the jurisdiction of the firm.
We use AI models under business agreements, not consumer chat tools. Which provider and which terms apply to your project is part of the written setup, and you approve it before anything runs.
For every workflow: purpose, data categories, systems, access, approvals, logging and incident steps on one page.
The workflows run in the environment we agreed on, with accounts you control. You can switch off access at any time.