Questions About Data Security and Privacy

Tax documents contain some of the most sensitive information you have: Social Security numbers, bank accounts, income, and family details. Identity thieves target tax professionals. Asking how a firm protects your information is reasonable and increasingly expected. Tax preparers are also subject to federal requirements to safeguard client data. This guide lists questions to ask.

How Do You Receive My Documents?

Ask how the firm wants you to send documents. A secure client portal, encrypted file transfer, or another protected method is preferable to ordinary email attachments. Ask whether the firm accepts documents by text message or messaging apps, and what the policy is for those channels. A firm that discourages unsecured methods is showing care.

Where Is My Data Stored?

Ask where your information is stored: on firm servers, in cloud services, or on staff computers. Ask whether the storage is encrypted and whether backups are made. You do not need technical details, but you should hear something about encryption and access controls.

Who Has Access?

Ask who within the firm can see your information and whether access is limited to those who need it. Ask whether contractors or offshore providers have access. If the firm uses outside services for preparation or review, ask how they are vetted and what protections apply.

What Security Practices Do You Use?

Ask about basic practices such as multi-factor authentication, strong passwords, software updates, endpoint protection, and staff training. Ask whether the firm has a written information security plan, which many tax professionals are expected to maintain. A firm that can name specific practices is more credible than one that says only that security is a priority.

What About Email?

Ask how the firm handles email that contains sensitive information. Ask whether it encrypts messages or uses a portal for sensitive exchanges. Be aware that regular email is not a secure channel, and consider limiting the details you send.

What Happens in a Breach?

Ask what the firm would do if there were a data breach. Firms may have obligations to notify affected clients and authorities. Ask how quickly clients would be notified and what support would be offered. Ask whether the firm has had any incidents, and how it responded. A candid answer is a good sign.

How Long Do You Keep My Records?

Ask about the retention policy and how records are disposed of at the end of the retention period. Ask whether you can request return of documents and deletion of certain data, subject to legal retention requirements. Keeping records too long increases exposure, and disposing too quickly may leave you without support if questions arise.

Do You Share My Information?

Ask whether the firm shares information with third parties, such as software providers, payroll providers, and marketing partners. Ask for the privacy policy. Tax return information is subject to consent requirements before it is used or disclosed for purposes other than preparing the return, with limited exceptions. Ask how the firm handles consent.

What Can I Do to Protect Myself?

You can take steps as well. Consider using an identity protection PIN from the IRS if available to you, use strong unique passwords, enable multi-factor authentication, and avoid sending documents over public networks. Monitor your accounts and credit for signs of misuse. Report suspected identity theft promptly.

What If Something Looks Wrong?

If you receive an unexpected notice, a rejected e-filed return because a return was already filed, or a transcript that shows unfamiliar activity, contact your advisor and the IRS identity protection resources. Speed matters.

Where AE Tax Advisors Fits

You can ask the questions above during a discovery call. A firm's answers, and its willingness to give them, tell you a lot about how it treats sensitive information.

Simple Habits That Reduce Risk on Your Side

Even with a careful firm, your own habits matter. Use a password manager, keep devices updated, and be cautious about emails asking for documents or account details. Confirm unusual requests by phone using a number you already know, not one in the message. Send only the documents needed for the work, and remove unnecessary personal information when possible. If you ever receive a request that seems to come from your advisor but looks odd, verify it before responding. Many incidents begin with a convincing message that is not what it appears to be.

Ask About Departing Staff

Ask how the firm handles access when staff leave, since access controls at the end of employment are a common gap. A clear answer suggests good discipline.

Questions About Software and Vendors

Many firms rely on outside software for preparation, document storage, e-signature, and communication. Ask which categories of vendors the firm uses and how it evaluates their security. You do not need a list of products, but you should hear that the firm considers security when choosing tools and that it reviews vendor practices periodically. Ask also whether client data is used to train tools or shared with vendors for purposes beyond delivering the service, and ask to see the relevant privacy terms.

E-Signature Practices

If the firm uses electronic signatures for engagement letters and returns, ask how identity is verified and how signed documents are stored. Clear practices here protect both you and the firm.

Educational purposes only. This page is general education and is not tax, legal, or accounting advice. Descriptions of how AE Tax Advisors approaches engagements are general, and the scope, timing, and fees for any engagement are confirmed with you directly. Tax laws change and outcomes depend on individual facts. No result is guaranteed.