Security

Your clients trust you with their tax returns. Here is how Firmdesk keeps them safe.

Hosted in Canada

The app, its database and your documents are on servers in Québec. Each firm's data is kept apart from every other firm's.

A few companies help run the service, and some of them are outside Canada: the privacy policy says what can leave Canada, and who helps run it names them.

Two-step sign-in

Everyone on your team signs in with a password and a second step. Your clients confirm a code sent to their email too, unless your firm turns it off.

Encrypted

Every connection to Firmdesk is encrypted, and so are our backups. Passwords are stored in a form nobody can read.

You decide who sees what

Each person's role sets what they can see, and a client's contacts see only what you share with them. Our own staff look at a firm's data only to run the service or when you ask for help.

An activity log

Sign-ins, documents opened, downloaded and shared, and changes to settings are recorded. Owners and admins can read the log and download it.

Documents stay in the portal

Documents are never attached to emails. Your clients open them in the portal after signing in, and they have no public address.

Signatures and payments

Each e-signature is confirmed with a code and recorded on a certificate at the end of the signed copy. Card and bank details are handled by Stripe and never reach Firmdesk.

Backed up every day

Backups are kept away from the servers, and we test restoring from them. The service is monitored around the clock.

Your data stays yours

Export everything at any time, or delete a client or your whole firm yourself. If a security incident affects your data, we tell you promptly.

Report a problem, or ask

Found a security weakness? Write to [email protected]. We answer within two business days, and we don't take action against people who report in good faith.

Filling in a security questionnaire for your own clients or your insurer? Ask us: we'll send our written answers.