GoRefer Trust Center
Tax Data Safeguards
Updated October 2026
Tax preparers are legally required to maintain a Written Information Security Plan (WISP) under the FTC Safeguards Rule (16 CFR Part 314) and IRS Publication 4557. This page maps selected program responsibilities to relevant GoRefer controls. It is not an exhaustive compliance checklist or proof that your firm meets every requirement; use the applicable rule and your own security assessment when preparing a WISP.
Legal requirement, not optional guidance
The FTC Safeguards Rule applies to all "financial institutions" — a category that explicitly includes tax preparers under 16 CFR § 314.2. Firms with fewer than 5,000 customer records still must maintain a written security program. Penalties for non-compliance include FTC enforcement action and potential IRS EFIN suspension.
FTC Safeguards Rule — 10 Required Program Elements (16 CFR § 314.4)
Designate a Qualified Individual
16 CFR § 314.4(a)
Your firm must designate its Qualified Individual. A GoRefer admin role provides product permissions; it does not itself appoint or qualify that person for regulatory purposes.
Conduct a Risk Assessment
16 CFR § 314.4(b)
Firm roles, practice compliance records and available audit information can inform your assessment. Security Hub monitoring is for authorized platform operators; it is not a firm-admin risk-assessment dashboard.
Design & Implement Safeguards
16 CFR § 314.4(c)
Supported sensitive fields use AES-256-GCM encryption, GoRefer's web app and API use HTTPS, and role and firm controls limit who sees what. Our hosting provider encrypts stored data by default, and nightly backups are encrypted before upload.
Regularly Test & Monitor
16 CFR § 314.4(d)
Security audit events record who did what and when; coverage varies by workflow. Repeated failed sign-ins lead to a lockout. Your firm is responsible for testing and monitoring its own program.
Train Your Staff
16 CFR § 314.4(e)
Training your staff is your firm's responsibility. Keep your firm's training records and WISP documentation in the system your organization has chosen.
Oversee Service Providers
16 CFR § 314.4(f)
Read our sub-processor list and our Data Processing Addendum, both public in the Trust Center. We email account administrators before a new service provider receives firm data.
Keep the Program Current
16 CFR § 314.4(g)
Our Trust Center changelog is public. When the Terms of Service or the Data Processing Addendum change, your firm's administrators are asked to accept the new version.
Create an Incident Response Plan
16 CFR § 314.4(h)
Your firm must have its own incident response plan. If GoRefer has a security event affecting your clients' information, we notify you as described on the Incident Response page: If we confirm unauthorized access to your firm's client information, we will notify your firm's administrators without unreasonable delay, and no later than 72 hours after we confirm it, with what we know, so your firm can meet its own notice duties. The FTC Safeguards Rule requires your firm to notify the FTC within 30 days of discovering that unencrypted customer information of 500 or more consumers was acquired without authorization.
Report to your board
16 CFR § 314.4(i)
Your Qualified Individual reports in writing, at least once a year, on the program's status and material matters.
Notify the FTC
16 CFR § 314.4(j)
Report a notification event involving 500 or more consumers to the FTC within 30 days of discovery.
IRS Publication 4557 — Safeguarding Taxpayer Data
Written Information Security Plan (WISP)
GoRefer provides a template WISP addendum specifically for tax preparers using cloud-based intake and document management. Covers data classification, access controls, incident reporting, and vendor management sections that reference GoRefer's published security posture.
Encryption of taxpayer data in transit and at rest
HTTPS protects browser requests. Supported sensitive intake fields use AES-256-GCM. Our hosting provider encrypts stored data by default, and nightly backups are encrypted before upload. The extension privacy policy covers the browser extension.
Access controls based on business need
Standard roles, custom permissions and assignment rules govern supported workflows. Data exports, billing and platform security have different permission requirements. Audit coverage depends on the action.
Multi-factor authentication
Two-factor sign-in is required for firm admins, and your firm can require it for preparers. The code comes by email or from an authenticator app. A device you choose to trust can skip the code for 30 days.
Secure disposal of taxpayer data
When a firm cancels, we show the date its data will be deleted. After the retention period ends, we delete the firm's workspace: its users, client records, messages, call recordings, voicemails and Gio cases, the documents stored for it in our current document storage, and its account with our phone provider, whose numbers are released. Records on legal hold are kept until the hold is released. Billing and payment records are kept for at least 7 years for tax and accounting purposes, proof that a person agreed to receive messages or asked to stop is kept in a reduced form for up to 5 years, and our security audit trail is kept. Deleted data can remain in our backups for up to 30 days, until those backups expire. Deleting individual records while the account is open is a separate, authorized action, and the practice retention ledger records decisions without itself destroying records. Each deletion is recorded. Ask legal@gorefer.io to confirm when your firm's data was deleted and what was kept. We do not guarantee that deleted data is overwritten on the underlying storage.
Employee / contractor access termination
Admins can deactivate a preparer account. Deactivation, ending sign-in sessions and access-token expiry are separate mechanisms, so deactivating an account does not immediately invalidate every token already issued.
Vendor due diligence
Our sub-processor list is published at gorefer.io/trust/subprocessors, and our Data Processing Addendum at gorefer.io/trust/dpa.
Incident reporting to IRS
Report data theft to your IRS Stakeholder Liaison and to your state tax agencies. See IRS Publication 4557 and the IRS page "Data theft information for tax professionals". If the incident involves GoRefer, we give your firm what we know to support that report.
Need a WISP template?
Request available WISP support documentation from the GoRefer team. Review and adapt it to your firm’s actual controls, risks and responsibilities before adopting it.
Common Questions
No. The WISP is your firm's document, not GoRefer's. GoRefer provides control descriptions and practice compliance records that can support your WISP. Your firm must assess and maintain its own plan.
Ask support@gorefer.io for security questionnaire answers. We can share our written information security program and incident response plan under NDA. These are not an independent audit or a guarantee that your firm meets its legal obligations.
GoRefer is not offered as a HIPAA service, and our Data Processing Addendum is not a Business Associate Agreement. Contact legal@gorefer.io before storing protected health information.
The extension fills your client's details into supported professional tax software; it does not make a firm compliant by itself. The tax software receives the values that are filled in. See the extension privacy policy for what the extension sends and stores.
Ready to simplify your Safeguards compliance?
GoRefer gives tax preparers security controls, audit logs and records that can support their own FTC Safeguards and IRS Publication 4557 program.
Start Free Trial