GoRefer Trust Center
Compliance
Updated October 2026
About this page. This page describes how GoRefer works today. It is not an independent audit or a contractual service level. For questionnaire answers, or for documents we share under NDA, make a request through the Trust Portal.
GoRefer is built for tax and accounting firms in the United States. This page sets out our own security program and the US laws your firm works under, and how GoRefer supports your firm under them.
Using GoRefer does not by itself make a firm compliant. Each firm remains responsible for its own legal obligations and practices.
Our Security Program
Updated October 2026
| Area | What GoRefer does | Status |
|---|---|---|
Written information security program (WISP) | GoRefer maintains a written information security program for the service. | In place |
Incident response plan | GoRefer maintains a written incident response plan. If we confirm unauthorized access to your firm's client information, we notify your firm within 72 hours of confirming it. | In place |
Encryption | AES-256-GCM on supported sensitive fields, HTTPS for every connection, encryption of stored data by our hosting provider, and encrypted nightly backups. | In place |
Access controls | Roles and permissions limit who sees what. Two-factor sign-in is required for firm admins, and your firm can require it for preparers. The code comes by email or from an authenticator app. A device you choose to trust can skip the code for 30 days. | In place |
Service provider oversight | A public sub-processor list and a Data Processing Addendum. We email account administrators before a new service provider receives firm data. | In place |
Documents on request
Firms can request our written information security program and incident response plan under NDA, and answers to security questionnaires, through the Trust Portal.
US Laws That Apply to Tax Firms
Updated October 2026
| Law or guidance | What it means with GoRefer |
|---|---|
Gramm-Leach-Bliley Act and the FTC Safeguards Rule (16 CFR Part 314) | Tax firms are financial institutions under these rules and must protect customer information, including by overseeing their service providers. GoRefer's Data Processing Addendum sets out the safeguards we keep as your firm's service provider. |
Internal Revenue Code §7216 | Limits how tax return information is used and disclosed. GoRefer uses your clients' return information only to provide the service to your firm, and never sells it or uses it for advertising. |
IRS Publication 4557 (guidance) | IRS guidance on safeguarding taxpayer data. GoRefer's controls can support the parts of your firm's program that cover the service. |
State privacy and breach-notice laws | Including the California Consumer Privacy Act. GoRefer acts as your firm's service provider for client data, and our notice commitment helps your firm meet its own breach-notice duties. |
California and Other State Privacy Rights
Updated October 2026
Your rights
Know what personal information we collect and how we use it
Get a copy of your personal information
Correct inaccurate personal information
Delete your personal information, subject to legal record-keeping duties
Opt out of the sale or sharing of personal information
Not be treated differently for using these rights
How to use them
Use Your Privacy Choices at gorefer.io/privacy/choices, or email legal@gorefer.io
Tell us your name, your email address and the right you want to use
We confirm your identity before acting on a request
We respond within 45 days, or tell you if we need up to 45 more
If you are a client of a tax firm that uses GoRefer, contact that firm first: it controls your information
Health Information and Users Outside the US
Updated October 2026
GoRefer is not offered as a HIPAA service, and our Data Processing Addendum is not a Business Associate Agreement. Contact legal@gorefer.io before storing protected health information.
The service is for businesses in the United States. If you are outside the United States, contact legal@gorefer.io before using it.