The short answer: the FTC Safeguards Rule (16 CFR 314.4(c)(3)) requires a tax practice to encrypt customer information at rest and in transit, unless its Qualified Individual reviews and approves effective alternative controls. The IRS says tax professionals must also keep a written information security plan. Most plans cover the portal and the tax software, then go quiet about the working folders on staff laptops and in Dropbox, Google Drive or OneDrive. ZapLock encrypts those folders where they sit, opens them only for the people you add, and removes a leaver in one step. The clause below puts that in your plan.
Four lines a tax practice's plan has to answer
The IRS treats tax and accounting professionals as financial institutions under the Gramm-Leach-Bliley Act, so the FTC Safeguards Rule applies. These are the parts that touch client files directly.
Encrypt at rest and in transit
Customer information is encrypted where it's stored and when it crosses external networks. If that isn't feasible, your Qualified Individual reviews and approves alternative controls.
Limit access to who needs it
Access controls, reviewed periodically, so each person reaches only the customer information their job needs.
Multi-factor authentication
MFA for anyone accessing any information system, unless your Qualified Individual approves equivalent or stronger controls in writing.
Write it down
The IRS reminded tax pros on 18 August 2026 that they must have a written, accessible plan. Publication 5708 is its free template for small practices.
The portal isn't where the work happens
Follow one client's W-2 through a busy week and count the places it lands.
Client portal
TaxDome, SmartVault, ShareFile and the like protect the upload and the download.
Tax software
The return data lives in the vendor's system, under its own access controls.
Working folders
Downloads, scans and workpapers in a client folder on a laptop, a USB drive or a shared Dropbox, Google Drive or OneDrive folder.
Lock the client folder itself, where it already is
Pick the folder and ZapLock encrypts every file in it in place with AES-256-GCM. It stays in the same spot, syncs as before, and opens only for the staff you add, on devices enrolled to their own sign-in. Turn on a required check and each unlock also asks for a fingerprint, face, PIN or a tap on their phone.
A WISP clause for working folders
Fill in the highlighted parts, delete the bracketed sentence if you don't require a check on unlock, and have your Data Security Coordinator sign off on it with the rest of the plan.
Encryption of client files at rest (working folders)
[Firm Name] keeps client PII that staff work on outside [tax software / client portal] only in folders protected by ZapLock, on firm computers, removable drives and [Dropbox / Google Drive / OneDrive]. ZapLock encrypts each file in a protected folder with AES-256-GCM where it is stored. A protected folder opens only for a staff member the Data Security Coordinator (DSC) has added to the firm's ZapLock team, signed in on a device enrolled to their own account. [Each unlock also requires a fingerprint, face or PIN check on the device, or approval on the staff member's phone.]
Staff do not save client PII outside protected folders, except in [tax software / client portal], which are covered in [section]. Files that existed before a folder was protected, including copies in the cloud provider's version history and trash, are deleted once protection is complete.
When a staff member leaves or no longer needs access, the DSC removes them from the ZapLock team no later than the day their other system access ends, and files the ZapLock removal report with the termination record (Attachment F).
The DSC reviews the list of protected folders and team members [quarterly] and after every staff change.
Where it goes in Pub 5708
Under the Personnel Accountability Policy, next to the line on encrypting stored PII. The template has no separate encryption heading.
The leaver sentence
Pair it with item E of the same policy, which turns off a terminated employee's logins. Note the removal date in Attachment F.
Service providers
List ZapLock (DaSecure Solutions LLC) among your service providers, with what it holds: account emails, enrolled devices, folder labels and a security log. Not your files.
What ZapLock covers, and what it doesn't
Covers
- Client folders on Mac and Windows, on removable drives, and in Dropbox, Google Drive or OneDrive folders.
- Access per person, tied to their own sign-in and their own devices. No shared folder password.
- A required check on unlock: fingerprint, face, PIN or approval on their phone.
- Removing a leaver from every team folder at once, with a report to file.
- Opening folders on iPhone, iPad and Android too.
Doesn't cover
- Email, your tax software's database or your client portal. Keep those under their own controls.
- Whole-disk encryption. Keep BitLocker or FileVault on firm laptops as well.
- MFA for your other systems, staff training, the risk assessment or the incident response plan.
- Copies made before a folder was protected, including cloud version history. Clear those yourself.
- Linux. ZapLock runs on Mac, Windows, iPhone, iPad and Android.
From clause to fact in an afternoon
Start ZapLock Team
Three seats minimum, bought on the web. Everyone who works on client files takes a seat, including you.
Protect each client folder
Pick the folder in ZapLock (on Windows, right-click it in File Explorer). Files are encrypted where they are, and the folder keeps syncing as before.
Add your staff
Invite each person by email. They sign in on their own laptop and phone; nobody shares a password.
Require a check on unlock
Turn it on for client folders so every unlock also asks for a fingerprint, face, PIN or approval on the person's phone.
Paste the clause and sign
Fill in the brackets, clear old copies from cloud version history, and file the plan with your Data Security Coordinator's signature.
WISP and encrypting client files: FAQ
Does the FTC Safeguards Rule require tax preparers to encrypt client files?
Yes. Section 314.4(c)(3) of the FTC Safeguards Rule says customer information must be encrypted at rest and in transit over external networks. If encryption isn't feasible somewhere, you may use effective alternative controls instead, but your Qualified Individual has to review and approve them. The IRS treats tax and accounting professionals as financial institutions under the Gramm-Leach-Bliley Act, so the rule applies to them.
Do tax preparers need a written information security plan (WISP)?
Yes. In IR-2026-92 (18 August 2026) the IRS and the Security Summit reminded tax professionals that they are legally required to have a written, accessible plan, and to review it regularly. IRS Publication 5708 is a free WISP template written for small practices.
Isn't our client portal enough?
A portal protects files while they move between you and your clients. Once a return or a bank statement is downloaded to a staff laptop, a shared drive or a Dropbox folder to work on, the portal no longer covers it. Those working folders are where ZapLock fits, alongside the portal, not instead of it.
Does using ZapLock make my practice compliant?
No single tool does. The Safeguards Rule asks for a whole program: a Qualified Individual, a written risk assessment, multi-factor authentication, staff training, oversight of service providers and an incident response plan. ZapLock covers one part of it: encryption at rest and per-person access for the folders where client files are worked on. This page isn't legal advice.
What happens to the folders when a staff member leaves?
On ZapLock Team, an admin removes the person once. Their share of every team folder's key is deleted on our side, so their next attempt to open any team folder is refused, even if their laptop is offline at the time. Everyone else keeps working without re-sharing anything, and the removal report goes in your termination record.
Can ZapLock see our clients' files?
No. Files are encrypted on your own computers with AES-256-GCM, and each folder's key is split between the device and our service, so we can't open your folders. We do hold account emails, enrolled devices, the label of each protected folder and a security event log, which is worth noting in the service-provider section of your WISP.
How much does ZapLock Team cost?
ZapLock Team is $9 per seat a month, or $90 per seat a year, with a 3-seat minimum, bought on the web. Everyone on the team takes a seat, including the buyer. See pricing.
Check it yourself
- 16 CFR 314.4, FTC Safeguards Rule: elements of an information security program (eCFR)
- IR-2026-92: IRS, Security Summit remind tax pros they need a written information security plan (18 August 2026)
- IRS Publication 5708: Creating a Written Information Security Plan for your Tax & Accounting Practice (Rev. 8-2024)
- IRS Publication 4557: Safeguarding Taxpayer Data
Checked 13 October 2026. Rules and guidance change; your Qualified Individual and your own adviser decide what your plan needs. This page isn't legal advice.
Make the encryption line in your WISP true.
ZapLock Team: $9 per seat a month, 3 seats minimum, on Mac, Windows, iPhone, iPad and Android.