Local workpapers. Clear processing boundaries.

Connect the folder that already holds your client folders: a folder on the computer, a network drive, or the folder your storage app or practice portal keeps on the computer, such as Google Drive for desktop, OneDrive or Dropbox. Clients and staff go on saving documents where they do now, and Taxably reads them there.

Each prep sheet is saved in its client's folder, in a Taxably Prep folder for the tax year, the same way a file your staff save there is. The sharing and permissions your firm has set on that folder apply to it, and if the folder is synced to your cloud storage or portal, the sheet reaches it the way your other files do. Taxably does not send the prep sheet itself anywhere else.

Taxably leaves your documents where they are and as they are, and renames them only if you turn on Rename my files in its Settings. Its own working records, including the working copy of your documents it reads from, are kept on the computer it runs on, apart from your client folders.

No report exists yet, so there is nothing to show you and no bridge letter to issue; we will publish the examination period and the auditor here when the engagement is signed. Ask us and we will tell you exactly where it stands, and share the control evidence we do have under NDA.

Taxably provides auxiliary services to tax return preparers under 26 CFR § 301.7216-2(d)(2), which makes us a tax return preparer too. Our DPA says so, and accepts the § 7216 criminal penalty and the § 6713 civil penalty that come with it. Our DPA also commits us to process your clients' tax return information, and permit access to it, only inside the United States. You remain responsible for the consents § 7216 requires from your own clients; we never solicit them.

Every system Taxably runs that stores or processes your clients' data is in the United States, and so is everyone who can reach it, including our staff and contractors. Documents are read by the reading provider named on the subprocessor list, and Taxably Connect sends them only to the provider's United States locations. It refuses the provider's global location, which serves a request from wherever there happens to be capacity and so does not guarantee that a request is processed inside the country. The provider does not report where each request is processed. An optional bulk reading mode, off by default, holds document content in a United States storage location for the length of the run and deletes it when the run ends; the DPA describes that separately from a single-document read, because storing a document and reading one are different acts.

Our written information security program has a named owner and documented safeguards, and was adopted on October 15, 2026. Adoption does not mean every control is complete: known gaps remain open, each with a remediation date. The WISP summary describes its scope and status; your firm remains responsible for its own program.

To the extent your firm is a financial institution under GLBA, Taxably acts as a service provider; our DPA includes the safeguards required for that role.

CCPA / CPRA, Colorado, Connecticut, Virginia, Utah, Texas, Oregon. We act as a service provider, never sell or share personal information, and honor verifiable consumer rights requests.

All data Taxably stores is held in United States data centers, and the Services are not offered outside the United States. Where your clients' documents are sent to be read is set out in the data residency card and on the subprocessor list.