Security
Built for tax data from the first line of code.
Your clients trust you with Social Security numbers and bank statements. These are the rules Apraxo is built on.
- Firm-only by default
- Every new or imported folder is visible to your staff only. Sharing with a client is a deliberate step, and actions that would share a file as a side effect ask first and name the client who gains access.
- Separated by firm
- Each firm’s data is isolated at the database level, so one firm’s queries can never return another firm’s rows.
- Access you can explain
- Staff see only the clients assigned to them unless you grant firm-wide access. Removing access takes effect on the person’s next request.
- Two-factor sign-in
- Staff sign in with a password plus an authenticator app or passkey. Sessions expire after eight hours.
- An activity log you can trust
- Every change is recorded with who, what and when. Personal details in the log can be erased on request without breaking the record.
- Encrypted, US-hosted
- Files are encrypted at rest and in transit and stored in the United States, with a second copy in another US region.
Your obligations under the FTC Safeguards Rule
Tax preparers must keep a written information security program (IRS Publication 4557). Paying firms get a template and a page that maps Apraxo’s controls to it, so your program reflects the tools you actually use.
Questions about security? Email security@apraxo.com.