GoRefer Trust Center
Trust Center
Updated October 2026
Unknown
Status unavailable
No recent status update
Your data and your clients' data deserve a clear explanation of how they are protected. This Trust Center describes GoRefer's security practices, privacy policies and commitments in plain language. GoRefer is built for tax and accounting firms in the United States.
See the security controls built into GoRefer and our published policies in one place. Our sub-processor list and Data Processing Addendum are public. Security questionnaire answers, our written information security program and our incident response plan are available through the Trust Portal.
AES-256
Field encryption for sensitive identifiers
Nightly
Encrypted backups, each kept 30 days
72 hr
Breach notice to your firm, at most
Logged
Sign-ins and sensitive actions
Security & Compliance Posture
Control Domain Scorecard
Encryption
AES-256-GCM field protection; HTTPS connections
Access Control
Roles and permissions, two-factor sign-in, session controls
Network Security
HTTPS, browser security headers, rate limits, bot checks
Data Protection
Field encryption for sensitive identifiers
Incident Response
Written plan; notice to your firm within 72 hours
Business Continuity
Nightly encrypted backups, kept 30 days; restores tested
AI Governance
No training on customer data, audit logged
Security Program
Written information security program and incident response plan
Compliance
GLBA, FTC Safeguards Rule, IRC §7216, state privacy laws
Browse by Topic
Security
Privacy & Data
Legal & Compliance
Our Core Data Commitments
We never sell your firm's data or your clients' data, and we never use your clients' data for advertising.
A firm administrator can download a ZIP export of the firm's records, stored documents and compliance records. The Data Retention page lists what it leaves out.
GoRefer policy prohibits using customer inputs to train models; provider terms govern external processing.
If we confirm unauthorized access to your firm's client information, we will notify your firm's administrators without unreasonable delay, and no later than 72 hours after we confirm it, with what we know, so your firm can meet its own notice duties.
Private Documents
Request security questionnaire answers, or our written information security program and incident response plan under NDA.
Request Access →
Report a Vulnerability
Found a security issue? Disclose it responsibly via our security contact form.
View Disclosure Policy →
Security Questions
Enterprise procurement, security questionnaires, or general inquiries.
security@gorefer.io →