Written information security plan

Draft for attorney review under IRS Publication 4557 and the FTC Safeguards Rule. This is not a completed plan and it is not legal advice.

The qualified individual is the owner of Triple Seven Studios LLC. The owner reviews access, vendors, and this plan.

Tax return information, Social Security numbers, ITINs, bank details, and link tokens are encrypted at rest with AES-256-GCM. Pages are served over HTTPS. Staff see a return only when their role requires it.

Staff sign in with a password and an authenticator. A client turns on the same two-step check before a linked account is stored. Sessions idle out.

We do not store a client's password for a bank or a government site. Linking uses a provider token, which is encrypted, or an official authorization such as Form 8821 or a state power of attorney.

Vendors that would hold tax return information, including a bank-link provider, an accounting file, payroll, and the IRS transcript service, are listed for the owner before a live key is used. Until that key exists, the desk stays in a sandbox and does not call the vendor.

Records are kept for seven years unless a shorter period is set on the account, and except a record a tax duty requires us to keep. A deletion request goes to support@tripleseven.studio.

If we learn of an incident involving tax return information, we write to the address on the account and to support@tripleseven.studio so the owner can notify the people the law requires.