Security & Privacy: how your SSN is handled.

Federal and state tax returns cannot be prepared or filed without a Social Security number (SSN) or Individual Taxpayer Identification Number (ITIN). We use this identifier to:

• Match your tax documents to the correct taxpayer and household members.
• Complete the required fields on Forms 1040, 1120, 1120-S and 1065.
• Submit your return electronically to the IRS and applicable state agencies.
• Verify your identity when you contact us about an existing return.

We treat your SSN as the highest-sensitivity data in our system. The controls below are in place from the moment you enter it.

• Entry is captured through an HTTPS form with strict transport security (HSTS).
• The full value is encrypted with AES-256-GCM and stored in a dedicated vault table.
• Decryption is performed only inside authenticated server functions, never in the browser.
• Database row-level security policies prevent one client or preparer from reading another taxpayer's vault record.
• Preparers access documents through short-lived, cryptographically signed URLs that expire after each use.

Your SSN is used only for the purpose of preparing and filing your tax return. We do not use it for marketing, advertising, credit checks or any purpose outside tax compliance.

• Document extraction reads names, amounts and employer details; SSN values are masked before any text leaves the OCR step.
• The full SSN is inserted into the authorized tax form only by a licensed preparer or approved e-file system.
• For business returns, owner and officer SSNs or EINs are handled with the same vault encryption and access controls.
• Federal law (IRC §7216) prohibits disclosing your tax return information for any non-filing purpose without your written consent.

Tax returns and supporting documents are retained for the period required by federal and state tax rules, generally a minimum of three years from the filing date or due date, whichever is later. After the required retention period ends, records are securely deleted from active storage and backups are purged on their normal expiration cycle.

• Return files and source documents: minimum 3 years after filing or due date.
• Signed consent records: duration of service plus any required legal period.
• Access audit logs: minimum 1 year.
• Encrypted vault data: destroyed when the associated return is deleted and no legal retention requirement remains.

You remain in control of your personal information. You can request a copy of your data, correct inaccuracies, or ask for deletion of records that are not subject to a legal retention requirement.

• Request a machine-readable export of your account and upload history from the client portal.
• Submit a data deletion request and track its status until completion.
• Opt out of marketing communications at any time; tax data is never used for marketing.
• Withdraw consent for offshore preparation at any time; US-based staff will continue your return.

We are a US tax preparation business, so several federal rules apply to your information directly. These are obligations on us, not optional policies.

• IRC §7216 and Treas. Reg. §301.7216 — we may not disclose or use your tax return information for anything other than preparing and filing your return without your separate, written, revocable consent. Each consent is specific to one return and is stored with it.
• Gramm-Leach-Bliley Act and the FTC Safeguards Rule (16 CFR Part 314) — tax preparers are financial institutions under this rule. We maintain a written security programme, a designated security lead, encryption, multi-factor authentication for staff, monitoring, vendor oversight and an incident response plan.
• IRS Publication 4557 and Publication 5708 — the safeguarding standards our Written Information Security Plan is built on.
• IRS e-file rules (Publications 1345 and 3112) — electronic filing is performed under an authorized EFIN, and every paid preparer works under a current PTIN.
• Circular 230 — professional practice, due diligence and record-retention standards for preparers.
• We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

Depending on where you live, state privacy law may give you additional rights. We extend the core rights below to all US clients rather than only to residents of states that mandate them.

• Right to know what personal information we hold about you and why we hold it.
• Right to a portable copy of your account and document history.
• Right to correct inaccurate personal information.
• Right to delete personal information that is not subject to a tax or legal retention requirement.
• Right to opt out of the sale or sharing of personal information — we do neither, so there is nothing to opt out of.
• Right not to be discriminated against for exercising any of these rights.
• California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah and Texas residents may exercise these rights by writing to us; we verify your identity before acting on a request.
• If a breach affects your information, we notify you and the applicable state authorities within the deadlines your state's breach notification law sets, and we notify the IRS Stakeholder Liaison and affected state tax agencies as Publication 4557 directs.

Administrators can configure automatic deletion schedules for revoked QR tokens, stale upload links and documents that have passed their legal retention period. You can also request deletion of your own account and non-required records from the portal. Full details are in our Records Retention & Deletion Policy.

Contact Mehul Shah at tax@ascentaxus.com or (816) 294-5633. Mailing address: 10124 N McKinley Drive, Kansas City MO 64157.

Also see our Privacy Policy, Data Security Plan, Trust & Compliance Center, Written Information Security Plan, Security Architecture, and Client Agreement.