Security & Compliance
Your clients' data, protected like it's our own.
You are handing us the trust your clients placed in you. We take that seriously. Here is exactly how we protect their information, and where we stand on the questions firms ask us most.
The controls we run today
Security isn't a badge for us, it's a set of daily habits. Here is what's in place on every engagement.
Access and authentication
- Multi-factor authentication on every system that touches your data
- VPN-secured connections for all work
- Restricted, locked-down workstations with no unauthorized downloads
- Encrypted storage of credentials
People
- Background-checked staff on every account
- Signed non-disclosure agreements, for the firm and for each team member
- Dedicated staff per client. No shadow working, no rotating strangers on your files
- Confidentiality treated as a condition of employment, not a suggestion
Data handling
- Least-privilege access: people see only the data their work requires
- We work inside your systems and tools wherever possible, so data stays in your environment
- Clear separation between clients, with no shared working files across accounts
Where we stand on SOC 2 and ISO 27001
We'll be straight with you: ArthaBiz is not SOC 2 or ISO 27001 certified today. We are planning for these certifications. We'd rather tell you where we stand plainly than hide behind vague wording, because the same honesty is what you'll get in our work.
What we can tell you is that the controls above are real, applied on every engagement, and open to your review. If your firm has a security questionnaire or its own requirements, send it over. We're happy to complete it and to adapt to the standards you work under.
How we handle US taxpayer information (IRC §7216)
IRC §7216 governs how tax return preparers may use and disclose taxpayer information. When a US firm sends tax return information to a preparer located outside the United States, the law requires the taxpayer's prior written consent before that information is disclosed.
Here is how we fit into that:
- Your firm obtains the required §7216 consent and remains the taxpayer's preparer of record.
- We work only with information your firm is authorized to share with us.
- We use that information solely to prepare the work you assign, and for nothing else.
- We keep it confidential and apply our data-safeguard controls to it, including handling Social Security numbers according to your firm's instructions.
- You review, sign, and file. Professional responsibility and the client relationship stay with your firm.
In short, we are built to support your §7216 compliance, not to complicate it.
You stay in control, always
We prepare and support. Your firm reviews, signs, and files. We never file on your behalf, and we never contact your clients unless you ask us to. You hold the relationship, the final sign-off, and the professional responsibility. We hold ourselves to the standards that make that safe for you.
Have a security question we didn't answer?
Ask it directly, or send us your firm's security questionnaire. We'll give you a straight answer either way.