Built for Your Peace of Mind
Security is the first objection a US firm raises about offshore work, so this page should be specific. Publish only the controls that are actually in place on launch day.
| Area | What we do |
|---|---|
|
Where data lives
|
We work inside your hosted tax software or remote desktop. Client files are not downloaded to or stored on our devices. |
|
Access
|
Unique logins, multi-factor authentication and least-privilege access. Access is removed the same day a team member leaves your account. |
|
Devices
|
Company-managed, encrypted laptops with endpoint protection. USB storage, printing and personal email are blocked. |
|
Workplace
|
Restricted-entry work area, clean-desk policy and no personal phones at workstations. |
|
People
|
Background checks, signed confidentiality agreements and annual security and phishing training. |
|
Incidents
|
A written incident response plan. We notify your firm within [24] hours of any suspected incident. |
How we protect your clients' data
Your clients trust you with their Social Security numbers, bank details and income. You are responsible for that data, and for every vendor who touches it. This page sets out what we do in plain terms, so your vendor review is quick. If your firm sends a security questionnaire, we'll complete it.
Your data stays in your systems
We work inside the portal, remote desktop or software your firm already uses. Client files aren't downloaded to or stored on our devices, and when an engagement ends we keep nothing.
Security controls
Where data lives
Client files are not downloaded to or stored on our devices. We work inside your systems.
Access
Unique logins, multi-factor authentication and least-privilege access. Access is removed the same day a team member leaves.
Devices
Company-managed, encrypted laptops with endpoint protection. USB storage, printing and personal email are blocked.
Workplace
Restricted-entry work area, clean-desk policy and no personal phones at workstations.
People
Background checks, confidentiality agreements signed before first access, and annual security and phishing training.
AI tools
We don't enter client data into public AI tools.
Written plan
We keep a written information security plan, and one named person is responsible for it.
Incidents
A written incident response plan. We notify you within 48 hours of any suspected incident.
Tax-law and regulatory compliance
IRC §7216 consent
Sending a client's return information to a preparer outside the US requires the taxpayer's written consent. We give your firm sample consent wording to review with your own counsel.
Social Security numbers on individual returns
For 1040-series returns the rules are stricter. The taxpayer must consent, and both firms must keep adequate data protection safeguards, which your firm confirms in its consent request. We provide the safeguard documentation you need and support masked or truncated SSN workflows where you prefer them.
FTC Safeguards Rule and IRS Publication 4557
Your firm must oversee its service providers. We keep a written information security plan and complete your vendor due-diligence questionnaire.
AICPA members
Our engagement terms are written so your firm can make any client disclosure the AICPA Code requires.
Who signs
Your firm is the signing preparer on every return. We prepare under your supervision and review. We don't sign returns, e-file under our own credentials or represent clients before the IRS. PTIN status is confirmed for each preparer during onboarding.
For your vendor review
Security documentation
We'll send a short security overview on request, and complete your firm's questionnaire within 2 business days. Questions about security go to security@anvivatax.com .
Transparent about certification
We don't hold a third-party security certification yet. Instead we show you every control above and answer your questionnaire in full.
Have a security questionnaire?
Send it over, or book a 20-minute call and we'll walk through it with you.
How We Support Your Compliance Obligations
We align our operations with U.S. tax standards and professional guidelines so your firm can maintain rigorous oversight and compliance.
IRC Section 7216
U.S. preparers must obtain taxpayer consent before disclosing return information to a preparer outside the United States. We provide sample consent wording for your counsel to review and fit our workflow around your consent process.
Social Security Numbers
We support masked or truncated SSN workflows where your consent form or firm policy requires them.
FTC Safeguards Rule & IRS Publication 4557
We keep a written information security plan and complete your vendor due-diligence questionnaire, so you can document service-provider oversight in your own plan.
AICPA Members
The Code of Professional Conduct expects members to tell clients before sharing confidential information with a third-party service provider. Our engagement terms are written so you can make that disclosure plainly.
Signing Responsibility
Your firm is the signing preparer on every return. Our preparers hold current PTINs and work under your supervision and review.