Data Security Policy

1. What Data We Protect

In the course of providing tax and accounting services, we may handle sensitive information including:

• Social Security Numbers and Tax Identification Numbers
• Income information, W-2s, 1099s, and tax documents
• Business financial records and bank statements
• Personal identification information

2. How We Protect Your Data

Digital Security

• All client files are stored in encrypted, password-protected systems
• We use Microsoft 365 Business for secure document storage and sharing
• File transfers use encrypted channels — we do not accept sensitive documents via standard email
• Our website uses HTTPS encryption for all data transmission

Physical Security

• Physical documents containing sensitive information are stored in locked filing systems
• Physical documents are shredded when no longer needed
• Access to client files is limited to authorized staff only

Staff Practices

• All team members are trained on data security best practices
• Client information is never discussed in public or unsecured settings
• We do not share client information with any third parties without explicit consent

3. Secure Document Sharing

For sharing sensitive documents, we use secure, encrypted file sharing through Microsoft OneDrive. You will receive a private, access-controlled link. We strongly discourage sending sensitive documents (W-2s, SSNs, bank statements) via standard email or text message.

4. Data Retention

We retain client tax records for a minimum of 7 years in accordance with IRS requirements. After the retention period, physical records are securely shredded and digital records are permanently deleted.

5. Data Breach Response

In the unlikely event of a data breach affecting your personal information, we will notify affected clients promptly in accordance with applicable Alabama and federal law, and take immediate steps to contain and remediate the breach.

6. Your Role in Security

You can help protect your data by:

• Using the secure OneDrive link we provide rather than emailing sensitive documents
• Keeping your appointment confirmation emails private
• Contacting us immediately if you suspect unauthorized access to your information
• Verifying our identity before sharing sensitive information (our number: 205.704.2251)