Security & privacy
How we protect your information, in plain English.
You trust us with some of the most sensitive information you have. This page describes what we actually do today. No system is perfectly secure, so we also tell you what to do if something looks wrong.
Last reviewed [date]
Your account
Your own login
Each client gets an individual portal account. Accounts are never shared between clients.
Multi-factor authentication
[Staff MFA statement - publish once MFA is switched on] [Client portal MFA - describe once confirmed]
Password rules & lockout
Weak passwords are rejected, and repeated failed sign-ins lock the account temporarily to stop guessing.
Account recovery
Password resets go only to the email address on file. [Identity check for changing that address]
Your documents
SENDING
Uploaded through the portal over an encrypted (HTTPS) connection. Never by ordinary email.
STORING
Kept on servers we manage, inside a private network with no direct internet access.
ACCESSING
Only the staff assigned to your return can open your file, and administrative activity is logged.
DISPOSING
Kept for [retention period], then securely deleted.
Our systems
- Encrypted connections (HTTPS) for every page and the client portal.
- Our servers accept no inbound connections from the internet; traffic reaches them only through an authenticated, encrypted tunnel.
- Automatic security updates, a firewall limited to our management network, and an audit trail of administrative activity.
- A written information security plan, as the FTC Safeguards Rule requires of tax preparers, reviewed [frequency].
- Service providers we rely on are listed in our privacy policy.
What CRJ will never do
- Ask for your password
- Ask you to email your SSN or documents
- Demand payment by gift card or wire
- Sell or rent your information
If something looks wrong
If you think your account was accessed by someone else, or you received a suspicious message claiming to be from us:
- Do not click links or reply to the message.
- Call us at [Practice phone], a number you know is ours.
- Change your portal password from a device you trust.
- We will review the account activity and tell you what we find.
Privacy summary
We collect only what we need to prepare your return and run the practice, use it only for that, and share it only with the tax authorities and the service providers named in our privacy policy.
Read the full privacy policy