How your financial records are handled

Email attachments are not encrypted in transit by default, they sit in two mailboxes indefinitely, and they get forwarded. So I don't accept tax documents that way.

Once you're engaged, you get an encrypted upload link tied to your engagement. Statements, W-2s, prior returns, and K-1s go through that. You can use it at any hour, including evenings and weekends, which is the point of running the practice this way.

If you send me something sensitive by email anyway, I'll tell you, and we'll move it.

The Texas Business Tax Calculator runs entirely inside your browser. Your revenue and profit figures are never transmitted, never written to storage, and never reach me or any third party. There is no account, no email gate, and nothing to opt out of.

This is checkable rather than a promise: open your browser's developer tools, switch to the network tab, and run a calculation. Nothing leaves.

The site is served over HTTPS only, with a set of response headers that constrain what a browser will do with it. These are set in version control rather than a console, so they are reviewable alongside the rest of the code.

The contact and intake forms ask for a name, an email address, an optional phone number, and what you need. They explicitly ask you not to include Social Security numbers or account numbers, because a marketing form is the wrong place for them and I'd rather not hold what I don't need.

There is no advertising pixel, no remarketing tag, no session recorder, and no heatmap tool on this site. The only cookie is Google Analytics, and the site works normally if you block it. The full list of who receives what is in the privacy policy.

The document redaction tool this practice uses strips Social Security numbers, EINs, and account numbers out of PDFs and Word files before anything reaches an outside platform. It runs offline on a local machine. Its audit log records that a file was scrubbed, not what was in it. A log that captures the sensitive values it was built to remove is worse than no log.

The same applies to statement ingestion and bookkeeping: it runs locally. Client data does not go into third-party tools that retain their own copy of it, and that includes AI services.

The practice maintains a written information security plan as required by the FTC Safeguards Rule and IRS Publication 4557. Its contents aren't published, but its existence and scope are what a prospective client is entitled to ask about, and I'll answer.

Your tax return information is additionally protected by IRC §7216, which makes improper disclosure a criminal matter rather than a policy question. That is covered in section 4 of the privacy policy.

Plenty of firms describe themselves as "bank-level" or "SOC 2 compliant". I'm not going to, because those words mean something specific and I'd rather you could trust the rest of this page.

• This practice does not hold a SOC 2 attestation. The site is hosted on Amazon Web Services, and AWS holds SOC 2 attestations covering its own infrastructure. That is Amazon's certification of Amazon, not a certification of this firm, and I won't present it as one.
• "Bank-level encryption" is marketing. What is true is that traffic to this site uses TLS, and that documents move through an encrypted link rather than email.
• No security is absolute. If something happened that affected your information, you'd hear it from me directly and quickly, along with what I knew and what I was doing about it.