The FTC Safeguards Rule and IRS Publication 4557 require every tax preparer to maintain a written information security program. Most small firms don't have one. Builtstead builds it, runs the systems behind it, and replaces the per-seat software around your tax stack with tools you own.
Under the FTC Safeguards Rule (16 CFR Part 314), a tax or bookkeeping practice is a financial institution. IRS Publication 4557 spells out what that means for preparers, and the IRS ties e-file provider status to it. A firm that can't produce a written information security program, an inventory of where client data lives, and evidence that it is backed up, encrypted, and monitored is carrying risk on its EFIN, not just its reputation.
Most two-to-ten-person firms know this and haven't had time to do anything about it. That is the problem Builtstead is built to take off your desk.
QuickBooks, Drake, Lacerte, ProSeries, UltraTax, Gusto: the compliance-critical core of your practice is not something we touch. Builtstead replaces the perimeter around it, the client portal, e-signature, scheduling, file storage, team chat, and intake forms, and then secures and manages the whole environment.
Look at your card statement. These are the line items that scale with every seat you add.
Per-user storage plans, and client documents sitting on a vendor's servers under their terms.
An owned, encrypted client portal on your own server. Clients upload, you organize, nothing leaves your control.
Per-seat licenses plus envelope limits, right when engagement letters and 8879s pile up in March.
Owned e-signature with unlimited envelopes and a complete audit trail, with signed copies filed automatically.
Another monthly seat per preparer, and reminder emails that come from someone else's domain.
Owned booking synced to your calendars. Confirmations, reminders, and document checklists send themselves.
Client conversations and intake data spread across tools you rent, each billed per person.
Owned team chat and intake forms that write straight into your client records, no per-user fees.
Discovery first. Most firms are live in about 30 days, with the new system running alongside the old one until cutover.
We map what you rent, what it costs at list price, where client data lives today, and what a Safeguards examiner would ask for. You get a written recap the same day.
A one-page design of the replacement system, which tools stay, which go, and a fixed one-time build price. No surprises after signing.
Your server, your domain, your accounts. Hardened, encrypted, backed up off-site, and monitored before a single client file is migrated.
Patching, backups, monitoring, support, plus WISP maintenance, quarterly security reviews, and incident-response readiness. Month to month, no per-user fees, export help included if you ever leave.
If yours isn't here, ask. You'll get a written reply, not a sales call.
Yes. The rule applies to tax preparers and bookkeepers regardless of size. Firms under 5,000 consumers are exempt from a few specific requirements, such as continuous monitoring and a written incident-response plan, but the core obligations still apply: a designated qualified individual, a risk assessment, access controls, encryption, and oversight of your service providers. We help you produce evidence for those, and we don't tell you a control is required when it isn't.
No. Those are the compliance-critical core of your practice and they stay exactly as they are. We replace the tools around them and manage the security of the whole environment.
It is a working program document aligned to 16 CFR Part 314 and Pub. 4557, maintained with your actual systems, backups, and access lists as evidence. It is currently under attorney review, and we'll tell you plainly where it stands rather than overstate it.
Everything runs on a server and domain in your name. We hand over all administrator credentials and documentation within seven days, and the system keeps running. Ownership isn't a slogan; it's how the contract is written.
Yes. Response commitments are in writing: four business hours for a system-down issue, eight for a degraded one, Monday through Friday, 8 AM to 6 PM Pacific. Patching runs in a scheduled monthly window, never in the middle of your day.
A 30-minute review of every subscription your business pays for: what it adds up to at list price, what you could own instead, and which admin tasks could run themselves. You get a written plan either way.
Veteran-owned · San Diego · Stop renting. Start owning.