Written Information Security Plan (WISP)

This is the public summary of Taxably, Inc.'s written information security program for Taxably Connect and its supporting services. It describes the program's scope, the safeguards implemented in the product, and the responsibilities that remain with your firm.

Program status: adopted October 15, 2026. Taxably's accountable owner adopted the internal program, which documents risk assessment, personnel requirements, vendor oversight, and incident procedures, on October 15, 2026. Adoption is a decision about the program, not about every control it describes: the program records known gaps, each with a remediation date, and they stay open until each is closed with its own evidence. Neither the adoption nor this summary is an independent compliance assessment.

1. Scope and accountability

Taxably's founder is the accountable owner of the program until that responsibility is formally reassigned. The program covers customer information processed by Connect, hosted account and operational information, access to Taxably systems, service providers, and personnel with access to those systems.

The written program calls for review at least annually and following material business changes, security incidents, or significant changes in risk. A scheduled review is a requirement, not a representation that a review has already occurred.

2. Administrative safeguards

The program documents risk assessment, access approval and removal, confidentiality obligations, security awareness training, vendor review, and incident handling. Personnel requirements apply before access is granted and as responsibilities change. These requirements do not, by themselves, evidence completed training or a completed access review.

Customer support should begin with the minimum information needed to diagnose a problem. Do not send taxpayer documents, tax IDs, credentials, or payment-card details in ordinary email or support forms. If sensitive evidence is necessary, ask for an appropriate handling arrangement first.

3. Technical safeguards

• Connect reads from folders your firm selects and keeps its working records and generated prep sheets on the firm's computer. AI processing transmits document content to the disclosed reading provider; local operation does not mean that no data leaves the computer.
• Network requests to hosted services use encrypted connections. Sign-in, paired-device authorization, firm-scoped access checks, and restrictions on internal administrative access protect the hosted service.
• Hosted firm records use access controls intended to keep one firm's information from another. Replacing client names with identifiers reduces exposure but does not make all operational information anonymous.
• The hosted account and operational database is encrypted at rest. On the firm's computer, Connect keeps its working records as ordinary files and does not lock them to the computer. Firms must protect the computer, its Windows account, the working records, and all outputs, relying on their own full-disk encryption and Windows account controls.
• Security-relevant activity and operational failures are recorded to support investigation. Operational reporting is designed around identifiers and processing metadata rather than source documents.

The AI & Model Training Policy explains processing, temporary storage, and the separate terms applicable to an assistant your firm connects.

4. Physical and workstation safeguards

Your firm controls physical access to its Connect computer and the folders, source documents, and exports it holds. Use a restricted Windows account, screen locking, device updates, disk encryption, and tested backups appropriate to your firm's own security program. Restrict access to shared folders and downloaded prep sheets as you would other tax workpapers.

Taxably's personnel policy also calls for device hygiene and restricted access. Hosted facilities are operated by the providers identified in the Subprocessor List; this page does not claim that Taxably operates its own data center or has independently certified those facilities.

5. Incidents and continuity

Documented incident procedures cover awareness, containment, investigation, evidence preservation, customer communication, remediation, and review. Breach notices follow the Data Processing Addendum and applicable law. Report a suspected security issue to security@taxably.ai.

The Business Continuity & Disaster Recovery Policy separates hosted-service recovery from the firm's responsibility for local records. Taxably does not maintain a cloud backup of your firm's complete Connect workspace.

6. Status and due diligence

An adopted program, completed training records, control testing, and independent reports are different kinds of evidence. Ask for the current status of each during your review. Available materials may be shared after confirming the requester's identity and appropriate confidentiality terms; sensitive operating procedures and system details are not published here.

The FTC Safeguards Rule requires covered businesses to implement and maintain a written program. Publishing this page alone does not satisfy that obligation or determine whether an entity is covered. See the FTC's guidance. Your firm's WISP and its legal obligations remain your firm's responsibility.

For program questions or supporting materials, email legal@taxably.ai. See the Security & Compliance Overview for current assurance status. This summary supplements the published agreements and does not reduce their protections.