A plain-language summary of how FirmLync handles client data, written for the firm owner deciding whether to use it — not a compliance certification. Questions not answered here: email us and we'll answer directly rather than pointing at this page.
FirmLync is a new product. We don't have a long customer track record, a SOC 2 report, or a dedicated security team — we want to be upfront about that rather than imply otherwise. What we do have: every control below is real and already live, not a roadmap item.
Two-factor authentication is mandatory for every firm-staff account, not optional — a password alone can't reach client data. Every firm's data is isolated by row-level security policies enforced in the database itself, not just application code: one firm can't query another firm's records, and a client portal login can only ever see that one client's own record. A log of sensitive actions taken with elevated access — payments, autopay changes, credentials used to send on a firm's behalf — is kept and viewable by the firm owner at any time in Settings.
Data is encrypted at rest and in transit, using our database provider's (Supabase) standard infrastructure-level encryption. This is not end-to-end encryption: standard encryption-at-rest protects against someone stealing a disk, not against the application itself reading data it needs to function. In practical terms, FirmLync's own operators can technically access stored data the same way any SaaS vendor's operators can — we don't claim otherwise, and any vendor who tells you their staff categorically cannot see your data (without describing actual client-side/zero-knowledge encryption) isn't being precise either.
Signing requires a one-time code emailed at the moment of signing, an explicit consent checkbox, a hash of the signed document, and an auto-generated audit-trail PDF for every signature — beyond just typing a name while logged into the portal. This covers engagement letters, consent forms, fee agreements, and other standard business documents under typical U.S. e-signature law (ESIGN/UETA).
It does not cover IRS Form 8878/8879 (e-file signature authorization) — the IRS requires identity verification (KBA) for remote signing of those specific forms, which requires a paid third-party identity-verification vendor we don't currently integrate. Firms use FirmLync for everything else and handle 8879 by wet signature, in person, or with a separate KBA-capable tool for that one form.
Tax and accounting firms handling client financial data are generally subject to the FTC Safeguards Rule and, for paid preparers, an IRS-required Written Information Security Plan (WISP) — not SOC 2, which is a voluntary market standard, not a legal requirement for this industry. FirmLync is built with the Safeguards Rule's technical expectations in mind (mandatory MFA, encryption, access logging), but your firm's own WISP and compliance obligations are yours to maintain — we're a tool your firm uses, not a substitute for your firm's own compliance program. Talk to your own counsel about what applies to you.
Supabase (database, authentication, file storage) is the only subprocessor every firm's data passes through by default. Stripe (payments) is used only for firms that connect it. Twilio (SMS follow-ups) and Anthropic (AI drafting) are included platform-wide — turning either feature on in Settings routes that firm's data through them, at no separate cost or setup. QuickBooks/Xero/SmartVault are used only if you connect them. See our Privacy Policy for the full list.
Our Terms of Service and Privacy Policy are drafted to be substantively accurate, but haven't yet had a full review by outside counsel — we'll update this page when they have. If your firm needs a signed Data Processing Agreement or has specific contractual requirements, email us before you sign up and we'll work through it directly.