Security
Security and confidentiality
How your documents move between us, why nothing travels as an email attachment, and why you will not find a phone number anywhere on this site.
Your return carries your Social Security number, your spouse's, your children's, the routing and account numbers on the direct deposit line, your employer, your brokerage, your address history. One year's file is enough for someone to open credit in your name, or to e-file a fraudulent return before you file the real one.
So the handling gets the same attention the return does. What follows is how documents actually move between us, why no phone number or email address is published on this site, and how to tell a real IRS letter from one built to scare you into a wire transfer.
Why your W-2 should never be an email attachment
Email copies itself by design. Attach a W-2 and it now exists in your sent folder, in my inbox, on both mail providers' servers, in whatever backups those providers keep, and on the phone in your pocket that syncs all of it. Deleting your copy deletes one of them. One compromised mailbox password, years later, hands a stranger every document in the thread.
The second problem is proof. Email gives neither of us a reliable record of what was sent, in which version, on what date. When a question comes up three years later about how a basis figure was built, I think I emailed that in March is a memory, not a document trail.
What happens instead
Documents move through Your Files, the vault inside the Tax Nucleus portal. Folders are organized by tax year. PDF preview lets you confirm you sent the right page without downloading anything, multi-select handles a stack at once, and every file carries a record of who uploaded it and when. Keep your own copies as well, for the periods IRS Topic 305 actually sets out.
Signatures work the same way. The engagement letter and the finished return are signed electronically inside the portal, and the signed copies stay there instead of living in an inbox. A household with more than one filer sits under a single login with an account switcher, so a spouse's return is reachable without a second password and without anyone emailing anyone a PDF.
Portal security, specifically
These are features of the software, not promises about attitude:
- Idle auto-logout, so a session left open on a hospital workstation closes itself
- E-signature on the engagement letter and on the return, with the signed copies retained in the portal
- An upload record showing who added each document and on what date
- A disclosures page stating in writing how your information is handled
- Folders by tax year, so a prior-year return is retrievable without asking anyone to resend it
- Nothing sensitive sitting in a mail provider's storage, because nothing travels as an attachment
How to get a document to me today
Fair question, and a page that argues this hard about email owes you a specific answer rather than a promise to sort it out later. The vault is running. What is not finished is the public sign-in page on this site, which is why there is no login button on it. That is a front door, not the building.
So the sequence right now has one manual step in it. You send a note through the contact form saying what you have. I open your account in Tax Nucleus and send you the invitation myself, and you upload into Your Files, foldered by tax year, exactly as it will work once the sign-in page goes up. The only difference between today and then is that I let you in by hand instead of you clicking Login.
The invitation takes you to Tax Nucleus to set your own password. I never see that password and I will never ask you for it. And I am not going to ask anyone to email me a W-2 in the meantime, which is the point of writing this down.
One rule that does not change when the login opens: the contact form is for messages, not documents. Describe what you have in plain words. No Social Security numbers, no account numbers, nothing attached.
The part the rules require, in writing
Some of this is not up to me. Under the FTC Safeguards Rule a paid tax preparer counts as a financial institution, which means a written information security plan is mandatory rather than a nice gesture. IRS Publication 4557 is the plain-language version of what it has to cover, and Publication 5708 is the template. I keep one. In a practice of one person, the section naming who is responsible for it is short.
The other half of the answer is where things live. Your files sit in Tax Nucleus, the software the portal runs on, built and operated by Tax Nucleus, LLC. Not a folder on a laptop, not an inbox, not a thumb drive that travels to a coffee shop. If client data were ever exposed, the obligations are not discretionary: tell the clients affected, report the theft to my IRS Stakeholder Liaison so the returns can be flagged against fraudulent filings, and notify state authorities where their law requires it. That is easy enough to write in advance, and the reason to write it is that plenty of practices have never thought the question through at all.
Why there is no phone number or email address on this site
That is deliberate, and it is not about being hard to reach. Contact details published on a professional site are harvested by bots within days, assembled into robocall and spam lists, and resold. A CPA's published address is worth more than most, because it is the raw material for one specific fraud: register a lookalike domain, imitate the firm, and email its clients asking them to send over a W-2 or update the bank account on a refund. Not publishing it removes the cheapest version of that attack.
So the form is the front door, and you should know what it runs on. It posts to Web3Forms, a relay service that takes the fields you filled in and hands them to me, which makes it one vendor standing in the path and worth naming rather than glossing over. It also ends up in an inbox, which is exactly why the form is for describing a situation and not for carrying documents. What you type there is not published, not indexed, and not added to any list by me. Once we are working together, the conversation moves into the portal, where it is logged.
How I will and will not contact you
I reply to conversations you start
If you reach out through the contact form, my response comes back to the address or number you gave me. I do not cold-call, and I do not run a follow-up sequence.
Client work happens in the portal
Document requests, questions during preparation, and the finished return all live there. If a message claiming to be from me asks you to email a document somewhere instead, it is not from me.
I will never ask for a password
Not yours, not your bank's, not the portal's. The portal invitation sends you to Tax Nucleus to set a password only you know. No legitimate request from me involves you typing credentials into a reply.
Nothing from this office is urgent about money
No real request from me requires you to move funds within the hour. Urgency about payment is the most reliable sign of a scam.
Telling a real IRS notice from a scam
The IRS opens contact by mail. Not by phone, not by text, not by email, and not by voicemail threatening arrest. A real notice arrives as a letter with a notice number in the upper right corner, usually starting with CP or LTR. A CP2000 proposes changes because a W-2 or 1099 the IRS holds does not match what you reported. A CP14 says there is a balance due. An LT11 is the final notice before a levy. Every one of them states what changed, why, what you owe or are owed, and how to disagree.
The tells:
- The IRS does not demand payment by gift card, wire transfer, or prepaid debit card
- It does not call to threaten arrest, deportation, or the revocation of a professional license
- It does not email a link asking you to verify a refund or confirm your identity
- A real notice always gives you a way to disagree and a date by which to do it
- You can look up any notice number at IRS.gov and read what that letter actually is
- You can confirm what the IRS believes you owe by pulling your own account transcript at IRS.gov
- Suspicious email claiming to be the IRS can be forwarded to phishing@irs.gov
If a letter arrives and you are not certain, get it in front of me and let me read it. Much of what people bring me is a routine adjustment that needs a written response signed and mailed by the date on the notice. Some of it is a fake printed well enough to fool a careful person.
Either way I would rather see it in the first week than after the response window closes. An unanswered CP2000 becomes a statutory notice of deficiency, and that one carries a hard 90-day clock to petition Tax Court. When a matter needs more than a letter, representation runs on Form 2848, which lets me deal with the IRS directly instead of relaying messages through you.
The plain version
A tax practice handles some of the most sensitive information a person has. Identity, income, family, bank accounts, and sometimes medical or legal history that surfaces only because it had a tax consequence. I keep it in one system that records who touched what, I do not move it through email, and I do not publish channels that make it easy for someone to impersonate me. That is the whole policy.
None of it is complicated. It is worth saying out loud only because plenty of firms still ask you to send a W-2 as an attachment. If you want to see how an engagement actually starts, that is on the getting started page.
Questions, answered plainly.
I already emailed tax documents to a previous accountant. Is that a problem?
It is not an emergency, and there is nothing to undo. Do three things anyway: change the password on that mailbox, turn on two-factor authentication, and delete the old attachments from your sent folder and your trash. If you want a stronger measure, request an Identity Protection PIN at IRS.gov. It is a six-digit number, reissued every year, and no return can be e-filed under your Social Security number without it. If a return has already been filed under your number, the fix is Form 14039, the Identity Theft Affidavit.
Can I just email you my documents anyway? It is easier.
I would rather you did not, for the reasons above. Send a note through the contact form describing what you have, and I will open your account in Tax Nucleus and send you the invitation, so the documents go straight into the vault instead of an inbox. It costs you a minute, it is the same place your files will live once the public login opens, and it keeps your W-2 off servers neither of us controls.
Who besides you can see my information?
The portal software is built and operated by Tax Nucleus, LLC, so their systems hold the files. The contact form posts through Web3Forms, which relays your message to me. That is the list. There is no back office, no seasonal staff, and no outside preparation shop, because there is nobody here but me doing the work.
How long do my documents stay available, and how long should I keep my own copies?
Prior-year files stay in the vault, filed by tax year, so you are not asking anyone to resend a return you already signed. Keep your own copies too. The short version of IRS Topic 305 is three years from the filing date for most returns, with longer windows for specific situations and no limit at all on a year that was never filed. The record retention guide in the tax center breaks it down situation by situation.
The first conversation is free.
Tell me what's going on and I'll tell you plainly whether you need me.
Schedule a Free Consultation