Information Handling

Email was never designed for sensitive files. Tax documents sent by email sit in inboxes indefinitely, get forwarded to the wrong people, get caught by spam filters, and are vulnerable to interception. Tax Portal Pro replaces all of that with a purpose-built secure upload system.

• Direct upload — clients upload W-2s, 1099s, bank statements, and other documents straight to their portal. No email attachments, no fax machines, no risk of sending to the wrong address.
• Controlled access — only your tax preparer and the specific team members assigned to your account can view your documents. A receptionist at the firm can't browse client files. An assistant can't access data they don't need.
• No public links — every single document download requires an active, authenticated session. There are no "shareable links" that could be copied, forwarded, or accidentally made public.
• Organized by project — documents are automatically grouped by tax year and project type, so nothing gets lost, misfiled, or mixed up with another client's paperwork.
• Permanent record — unlike email, where attachments get buried in threads, the portal keeps a clean, searchable record of every document uploaded, when it was received, and who has accessed it.

Tax Portal Pro serves many tax firms on the same platform, but each firm operates in its own completely private environment. Think of it like separate safety deposit vaults inside the same bank — you can only open yours, and the bank can't mix up the contents.

• Firm-level walls — every piece of data in the system is tagged with a firm identifier. Every single request the system processes checks that identifier before showing anything. There is no admin shortcut, no master view, and no way for one firm to see another firm's clients, documents, messages, or any other data.
• Separate branding — your firm's portal has its own colors, logo, domain name, and identity. Your clients see your brand when they log in, not ours. It feels like your own custom software because, in every way that matters to your clients, it is.
• Independent settings — each firm controls their own appointment types, document categories, team roles, reminder settings, invoice templates, and workflows. Changes one firm makes never affect another.

Your data is protected by two independent layers of encryption — even if one were somehow compromised, the other still protects you.

• In transit (the connection) — every connection between your browser and Tax Portal Pro is encrypted using HTTPS, the same standard used by banks and financial institutions worldwide. We don't just support encryption — we enforce it. If someone or something tries to connect without it, they're automatically redirected to the encrypted version. We also tell your browser to remember this, so it never even tries the unencrypted version again.
• At rest (the storage) — your most sensitive identifiers — Social Security numbers, EINs, and ITINs — are encrypted a second time before they're stored in our database. We use AES-256 encryption, the same standard the U.S. government uses for classified information. Each value gets its own unique random component, so even if someone gained access to the raw database, every single number would appear as meaningless scrambled text that can't be reversed without the encryption key.

Not everyone at a firm needs access to everything, and not every team member should see the same data. Tax Portal Pro uses a carefully designed role system that controls exactly what each person can do:

• Firm owners — the person who set up the account. They manage billing, team members, branding, and all firm-wide settings. They have the broadest access.
• Managers — oversee daily operations, assign clients to preparers, and manage team workflows. They can see team activity but might not need direct access to every client file.
• Tax preparers — work directly with clients and their documents. They see the clients assigned to them and can access the documents, forms, and communications needed to prepare taxes.
• Assistants — support preparers with a more limited set of capabilities. They can help with basic tasks but don't have access to certain sensitive operations.
• Quality reviewers — focus specifically on reviewing documents for completeness and accuracy. They see what they need to review, not the full client relationship.
• Clients — can only see their own documents, forms, messages, invoices, and appointments. They cannot see other clients' data, the firm's internal operations, team discussions, or anything that doesn't directly involve them.

Your login experience is powered by Google's authentication infrastructure — the same system that protects billions of Google accounts worldwide. Here's what that means for you:

• We never store your password — when you create a password for Tax Portal Pro, it's handled entirely by Google's secure systems. We literally don't have access to it, so even in a worst-case scenario, your password can't be exposed from our side.
• Sign in with Google — if you already have a Google account, you can use it to log in. This means one less password to remember, and you benefit from whatever security measures you've set up on your Google account (like two-factor authentication).
• Automatic timeout — if you step away from your computer for more than 10 minutes, your session automatically locks. This prevents someone from walking by and accessing your data on an unattended device.
• Secure sessions — your login session uses a specially protected cookie that cannot be read by other websites, cannot be accessed by JavaScript running on the page, and is only sent over encrypted connections. This prevents common attacks like session hijacking.

When your tax preparer sends you a document to sign electronically, the system creates a unique, secure signing experience just for you:

• One-time link — you receive a unique link that can only be used once. After you sign, it's permanently deactivated. Nobody can reuse or share your signing link.
• Time-limited — signing links expire after 48 hours. If you don't sign in time, your preparer can send a fresh one. Old links can't be revived.
• Identity verification — before you can view the document, you may be asked to verify your identity through a knowledge-based challenge. This ensures the right person is signing.
• Complete audit trail — the system records exactly when you received the link, when you opened it, when you viewed the document, and when you signed. This creates a legally defensible record of the signing event.

Tax firms can use their own web address — like portal.yourfirm.com — to give clients a fully branded experience. Even when using a custom domain, every security protection described on this page applies in full:

• Connections are encrypted with HTTPS and automatically redirected from HTTP
• SSL certificates are provisioned automatically for every custom domain
• Sessions, access controls, encryption, and firm isolation all work exactly the same
• Your clients see your brand with our security infrastructure working invisibly behind the scenes

Tax firms control how long client records are kept, based on applicable federal and state tax regulations and professional standards. The IRS generally recommends keeping records for 3–7 years depending on the type of return and circumstances.

If you want your personal data removed from Tax Portal Pro, email support@taxportalpro.com. We'll process your request within 30 days. If we're legally required to keep specific records (for example, to comply with a tax hold or audit), we'll let you know which data we need to retain and why.