LEGAL & COMPLIANCE

Security & Compliance

Protecting Your Data and Your Practice

Effective Date: September 28, 2026 | Version 1.0 | TaxLogistics LLC

Our Commitment to Data Security

TaxLogistics operates as a tax technology service bureau providing software and platform services to Electronic Return Originators (EROs), tax preparation businesses, and financial professionals. We take the security and privacy of taxpayer data and business information with the utmost seriousness. This page outlines our security practices, regulatory compliance standards, and the measures we take to protect your data and the data of the clients you serve.

01 IRS Publication 4557 :
Safeguarding Taxpayer Data

TaxLogistics aligns its data security practices with IRS Publication 4557: Safeguarding Taxpayer Data, the IRS official guidance for tax professionals. Our platform is designed to support EROs in meeting their own Publication 4557 obligations.

Written Information Security Plan (WISP) - TaxLogistics maintains a formal WISP that documents our security policies, procedures, and responsibilities for protecting taxpayer data.
Access Controls - Access to taxpayer-related data is restricted to authorized personnel only, using role-based permissions and multi-factor authentication.
Vendor Oversight - All third-party service providers with access to data are assessed for security compliance prior to engagement.
Employee Training - Staff with access to sensitive data receive regular data security training.
Incident Response - We maintain a documented Incident Response Plan to detect, respond to, and report data security incidents in accordance with IRS guidance.

EROs using TaxLogistics are responsible for their own IRS Publication 4557 compliance. TaxLogistics provides tools and infrastructure to support but does not replace each ERO's individual compliance obligations.

02 FTC Safeguards Rule Compliance

As a financial services technology provider, TaxLogistics is subject to the Federal Trade Commission (FTC) Safeguards Rule under the Gramm-Leach-Bliley Act (GLBA). The updated FTC Safeguards Rule effective June 2023 requires financial institutions including tax preparation businesses to maintain a comprehensive information security program.

Designation of a qualified individual to oversee our information security program.
Risk assessment of all systems that collect, store, or transmit customer information.
Implementation of safeguards to address identified risks.
Regular testing and monitoring of security controls.
Written Information Security Plan (WISP) reviewed and updated annually.
Oversight of service providers through contractual data security requirements.
Incident response plan with defined timelines for response and notification.

03 EFIN & ERO Platform Requirements

TaxLogistics serves licensed Electronic Return Originators (EROs) who hold active Electronic Filing Identification Numbers (EFINs) issued by the IRS. Our platform is built to support ERO compliance requirements.

EFIN Verification - EROs are required to provide proof of valid EFIN authorization upon account setup. TaxLogistics does not permit use of the platform by unlicensed preparers.
IRS e-File Standards - Our platform supports IRS-approved electronic filing specifications and transmission standards.
PTIN Requirements - EROs using TaxLogistics must maintain current PTIN registration as required by IRS regulations.
Continuing Education - TaxLogistics encourages and supports ERO participation in IRS Annual Filing Season Program (AFSP) and Continuing Professional Education (CPE) requirements.
Multi-Site ERO Support - Service bureaus and multi-office ERO operations are supported with appropriate access segregation and audit logging.

03A

Business Formation & Identity Data Protection

TaxLogistics protects business formation and identity documents with secure transmission, restricted access, and controlled retention.

Document Upload Encryption - All government ID uploads, SSN/EIN document submissions, and state formation filings are transmitted using 256-bit SSL encryption.
Restricted Legal Access - Personal identification submitted for LLC formations is accessible strictly by assigned processing team members solely to complete state government filings.
File Purging Policy - Client identity documents are stored in encrypted cold storage and retained strictly in accordance with state and federal recordkeeping laws.

04 Encryption & Data Storage

Data in Transit

All data transmitted between users, EROs, and TaxLogistics servers is encrypted using TLS 1.3 (HTTPS). Unencrypted connections are not accepted.

Data at Rest

Data stored within the TaxLogistics platform is encrypted at rest using AES-256 encryption, the same standard used by financial institutions and government agencies.

Cloud Infrastructure

TaxLogistics utilizes enterprise-grade cloud infrastructure with SOC 2 Type II certified hosting providers. Our infrastructure is hosted in the United States.

DNS & Network Security

TaxLogistics operates under Cloudflare enterprise-grade DNS and network protection, including DDoS mitigation, Web Application Firewall (WAF), and SSL/TLS certificate management.

Email Security

Business communications are conducted through Google Workspace, which provides encryption in transit, spam and phishing filtering, and Google Vault for email archiving and legal hold capabilities.

Backups

Data is backed up regularly. Backup data is encrypted and stored separately from primary systems.

04A

TaxLogi CRM & Messaging Security

TaxLogi CRM secures messaging and contact data using carrier-compliant encryption, strict account isolation, and multi-tenant partitioning.

Carrier-Level Compliance - TaxLogi CRM utilizes encrypted A2P 10DLC compliant messaging pipelines for SMS and email automation.
Zero-Sale Mobile Policy - Contact records, phone numbers, and messaging opt-in data uploaded into TaxLogi CRM are strictly isolated per account and are NEVER sold, shared, or rented to external marketing vendors.
Isolated Account Databases - Multi-tenant database architecture ensures client CRM leads and customer records are logically partitioned and inaccessible by other platform accounts.

05 Access Control

TaxLogistics enforces strict access control policies across all systems and personnel.

Role-Based Access

Users are granted access only to data and functions required for their role.

Multi-Factor Authentication (MFA)

Required for all administrative and staff accounts.

Password Policy

Strong password requirements enforced across all platform accounts.

Session Management

Automatic session timeouts for inactive sessions.

Audit Logging

Access to sensitive data and administrative actions are logged.

Least Privilege Principle

No user holds more access than their role requires.

Account Termination

Access is revoked immediately upon staff departure or role change.

06 Incident Response

TaxLogistics maintains a documented Incident Response Plan (IRP) governing our response to data security events.

In the event of a security incident involving your data:

1) Detection & Containment - Our team immediately identifies and contains the incident.

2) Assessment - We evaluate the scope, type, and potential impact.

3) Notification - Affected EROs and clients notified per federal, state, and IRS breach notification laws.

4) Remediation - Corrective action taken to prevent recurrence.

5) Documentation - All incidents documented as part of our continuous security improvement process.

To report a suspected security incident email [email protected] - monitored during business hours. For urgent matters contact us directly.

07 Software Security Standards

TaxLogistics follows industry-recognized software security standards.

OWASP Top 10 - Our development practices address the OWASP Top 10 web application security risks.
Secure Development Lifecycle (SDLC) - Security is integrated throughout our entire development process.
Dependency Management - Third-party software dependencies monitored and updated for known vulnerabilities.
Penetration Testing - We conduct periodic security assessments of our platform.
Change Management - All production changes follow a documented change management process.
Vulnerability Disclosure - We maintain a responsible disclosure process for security researchers.

08 Third-Party Service Providers

TaxLogistics works with carefully selected third-party technology providers, each evaluated for security compliance.

Google Workspace

Role: Business email, document storage, and collaboration

Security Standard: SOC 2, ISO 27001, Google Vault

Cloudflare

Role: DNS, CDN, WAF, and DDoS protection

Security Standard: SOC 2 Type II

Enterprise CRM Platform

Role: CRM, client portal, and communications

Security Standard: SOC 2 Type II

Data shared with third-party providers is governed by Data Processing Agreements (DPAs) requiring them to maintain appropriate security standards.

09 Data Retention & Destruction

TaxLogistics follows defined retention and secure destruction practices for client and ERO data.

Client and ERO data is retained for the duration of the service relationship plus applicable legally required retention periods.
Upon account termination, data is retained per IRS record-keeping requirements then securely destroyed.
Secure deletion methods ensure data cannot be recovered after destruction.
Data destruction is documented and recorded.

10 Your Responsibilities as an ERO

TaxLogistics provides a secure platform but your security matters too. As an ERO using TaxLogistics you are responsible for:

Maintaining your own WISP as required by the IRS.
Controlling who in your office has access to your TaxLogistics account.
Keeping your login credentials confidential.
Enabling MFA on your account.
Reporting any suspected unauthorized access immediately.
Complying with IRS Publication 4557 obligations for your practice.
Maintaining your EFIN and PTIN in active valid status.

11 Regulatory References

Publication 4557: Safeguarding Taxpayer Data

IRS

Applies to: All tax preparers and service bureaus.

FTC Safeguards Rule (GLBA)

Federal Trade Commission

Applies to: Tax preparers as financial institutions.

Publication 5293: Data Security Resource Guide

IRS

Applies to: Tax professionals.

IRC Section 7216

IRS

Applies to: Disclosure of tax return information.

Publication 3112: IRS e-file Application & Participation

IRS

Applies to: EROs and EFIN holders.

SECURITY

Fraud Awareness & EFIN Protection

Platform security is only one layer of protection. Our Anti-Fraud Policy goes further covering EFIN theft prevention, IRS impersonation red flags, phishing awareness, and step-by-step guidance for reporting suspected fraud as an ERO partner.

Read the Anti‑Fraud Policy

Questions About Our Security Practices?

We are committed to transparency. If you have questions about our security practices, data handling, or compliance posture, please contact us.

[email protected]
taxlogistics.org/contact

Contact Our Team

TaxLogistics LLC Statesboro, GA 30458

(912) 333-3821 · [email protected] · Mon–Fri 8AM–5PM ET

Fraud Prevention & ERO Security

Protecting your EFIN and your ERO practice is at the core of everything we do at TaxLogistics. Review our Anti-Fraud Policy to learn how we shield ERO partners against identity theft, phishing schemes, and EFIN fraud, and what to do if you spot a threat.

Review Anti-Fraud Policy