Security Controls That Protect Your Clients' Data
Multifactor authentication for every person in your firm, and a clear account of what Remindoo covers and what stays with you.
Remindoo gives US accounting firms multifactor authentication with an authenticator app and a single setting that requires MFA for every employee in the firm. Controls like these can support a written information security plan, but the plan, the training and the response process stay with your firm.
Last updated: September 16, 2026 · Reviewed by Waqas Sagar, ACA FCCA, chartered accountant (UK) and founder of Remindoo.
Key facts
- Account-level MFA using an authenticator app, with a device name and a confirmation code
- One setting in Global Settings requires MFA for every employee, with a confirmation step
- Employees are invited by email and set their own password
- Remindoo makes no compliance guarantee and holds no security certification claim
- Ask us for security information before you sign — we will answer in writing
Why security matters for US tax and accounting firms
Tax preparers are covered by the FTC Safeguards Rule
Firms that prepare tax returns are treated as financial institutions and are expected to keep a written information security program, with multifactor authentication for anyone accessing customer information.
The IRS publishes guidance you are measured against
Publication 4557 covers safeguarding taxpayer data and Publication 5708 provides a sample written information security plan. Buyers, insurers and peer reviewers ask about both.
Seasonal staff widen the surface every spring
Temporary preparers need access fast and lose it slowly. Without enforced sign-in protection and a deliberate off-boarding step, the risk sits in your firm long after the season ends.
How Remindoo handles it
| Problem | Workflow in Remindoo | Outcome |
|---|---|---|
| Staff sign in with a password alone | Each person turns on MFA in account settings and links an authenticator app | A stolen password is no longer enough to reach client data |
| MFA adoption is voluntary and patchy | Global Settings › Security › require MFA for all employees, confirmed before it applies | Every person in the firm is covered by the same rule |
| Your security plan has nothing to point at | Document the MFA controls in Remindoo inside your written information security plan | A specific, evidenced control instead of a general statement |
How it works
Turn on MFA for your account
Open account settings and switch multifactor authentication on. Remindoo asks you to name the device so you can tell your authenticators apart later.
Link an authenticator app
Scan the code with an authenticator app such as Google Authenticator, then enter the generated code once to confirm the link.
Require MFA for every employee
In Global Settings › Security, switch on the firm-wide requirement. Remindoo asks you to confirm before it applies to everyone.
Brief your team before you enforce it
Tell staff which authenticator app to install and when the rule starts, so nobody is locked out mid-season.
Record the control in your plan
Add the MFA settings, who enabled them and the date to your written information security plan, and review it on a schedule.
Review access at the end of the season
Walk the employee list, confirm who still needs an account and remove the people who do not.
Want to review Remindoo's security controls with your team? Book a walkthrough and bring your vendor questionnaire.
Book a demoWhat Remindoo covers and what stays with your firm
| Area | Controls in Remindoo | Still your firm's responsibility |
|---|---|---|
| Sign-in protection | Authenticator-app MFA and firm-wide MFA enforcement | Choosing the authenticator app, enrolling staff, replacing lost devices |
| Written plan | None — Remindoo is not a compliance document | Writing and maintaining the WISP itself |
| Risk assessment | None | Identifying where client data lives and what threatens it |
| People | Employee records and invitations | Security training, phishing awareness and disciplinary policy |
| Devices and network | None | Laptop encryption, updates, anti-malware and home-office rules |
| Incident response | None | The response plan, notification steps and contacting the IRS Stakeholder Liaison |
| Vendors | Answering your security questions in writing | Vendor oversight across every tool your firm uses |
Where the rules come from
The rule text itself, including the information security program requirement
Plain-English business guidance from the FTC
IRS guidance for tax professionals on protecting client data
A sample WISP for smaller tax practices
Who to contact if client data is stolen, including the Stakeholder Liaison
This is general information, not legal advice. Confirm your firm's obligations with a qualified adviser and with the primary sources linked on this page.
Tax season: seasonal staff access checklist
An example checklist to adapt, not a compliance requirement.
- Create a least-privilege role for seasonal preparers rather than reusing a manager role
- Limit what they can see to the work assigned to them
- Require multifactor authentication before the first login
- Agree in writing which devices they may use
- Review every seasonal account at the end of the season and remove what is no longer needed
Remindoo provides controls that can support your firm's written information security plan. Your firm remains responsible for its own compliance.
Frequently asked questions
Does Remindoo support multifactor authentication?
Yes. Each person can switch MFA on in their account settings and link an authenticator app by naming the device, scanning the code and entering one generated code to confirm.
Can I require MFA for all staff?
Yes. In Global Settings › Security there is a setting that requires multifactor authentication for all employees. Remindoo asks you to confirm before the rule applies across the firm.
Which authenticator apps work?
Authenticator apps such as Google Authenticator. If your firm standardizes on a different app, confirm it with us before you enforce MFA across the team.
Does using Remindoo make my firm compliant with the FTC Safeguards Rule?
No. No single tool makes a firm compliant. Remindoo provides controls, such as multifactor authentication and firm-wide enforcement, that can support specific elements of your written information security plan. The plan, the risk assessment, the training and the response process remain your firm's responsibility.
Do you support text-message codes for MFA?
Use an authenticator app. We only describe controls we have confirmed, and authenticator-app MFA is the method we support on the screens you will see in a demo.
Where can I get security information for our vendor review?
Book a walkthrough and tell us it is a security review. We will go through the controls with your team and answer your questionnaire in writing rather than pointing you at a marketing page.
Related for US firms
Security questions? Request our security information.
Request security informationReview the controls with your own security checklist
We will walk through multifactor authentication and firm-wide enforcement, then answer the questions your written information security plan raises.