Security for the most sensitive files your firm holds
Filed reads your clients' W-2s, K-1s and prior-year returns. Here is how we protect them, who audits us, and how your IT team gets the reports.
Schellman, an independent CPA firm and ANAB-accredited certification body, examines our SOC 2 controls and certifies our information security management system every year.
What we commit to with your clients' data
How Filed handles the documents and returns your firm sends it.
Your data never trains AI models
Filed never uses client data to train models, and never shares it across firms. Our AI model providers work under zero data retention terms, so they don't keep your data after a request.
It stays in the United States
Client data is stored and processed on US servers, and backups are kept in a separate US region.
It is used only to do your firm's work
Filed acts as your service provider under IRS Section 7216. Taxpayer data is used to prepare and review your returns, and for nothing else.
Every firm is walled off
Each firm's data is kept separate from every other firm's, so your client files never mix.
Access is limited and logged
Filed staff get access to customer data only through their role, behind multi-factor authentication, and every access is logged.
It's yours to take back
Ask us to delete or return your data and we do it within 60 days, as set out in our data processing agreement. Backup copies age out on our backup retention schedule.
Reports and certificates
Everything below is in our trust portal. The ISO certificate and SOC 3 report are public. The rest is shared under NDA.
Built to the standards of the firms we serve
Encryption
AES-256 at rest and TLS 1.2 or higher in transit.
Role-based access
Role-based permissions, MFA on internal systems, automated account management and logged access.
Tested and patched
A third-party penetration test every year and firewalls on our network. Our policy is to fix critical issues within 24 hours.
Backups and recovery
Backups in a separate US region and a written business continuity and disaster recovery plan.
Every number traces to a source
Each value Filed enters or flags links back to the page of the document it came from.
Sign-offs on the record
Preparer, reviewer and partner sign-offs are recorded with a name and time, and go stale if the item changes afterwards.
A vetted team
Background checks before hire, security awareness and privacy training, phishing tests, and encrypted, centrally managed laptops.
Monitoring and incident response
Systems are monitored and logged, with a written incident response plan. Uptime is public at status.filed.com.
Who else touches the data
All in the US. We tell customers before adding a new one.
Getting through your IT review
Most firms add Filed to the vendor section of their written information security plan. This is what your reviewer will need.
Start at the trust portal
Our ISO 27001 certificate, SOC 3 report, policy list and subprocessor list are at trust.filed.com.
Request the full reports
The SOC 2 Type II report, penetration test and AI provider documents are shared under NDA. Our DPA is available on request.
Send us your questionnaire
SIG, CAIQ or your own. Email it to security@filed.com and we will work through it with your IT team.
Request security documents
Request access in our trust portal. You'll accept a short NDA, and once our security team approves the request you can download the SOC 2 report, pen test, DPA and AI provider documents.
Need help with a security questionnaire or a call with our team? Email security@filed.com
Once your request is approved, the trust portal emails you a login link.
Security and compliance FAQ
The questions IT reviewers and partners ask most when they assess Filed.
Is Filed SOC 2 compliant?
Yes. Filed has a SOC 2 Type II report from Schellman, an independent CPA firm. It covers Filed's security controls over twelve months, from July 1, 2025 to June 30, 2026. The full report is shared under NDA, and a SOC 3 summary is public at trust.filed.com.
Is Filed ISO 27001 certified?
Yes. Filed's information security management system is certified to ISO/IEC 27001:2022 by Schellman, an ANAB-accredited certification body. Certificate 1138856-1 was issued on October 16, 2026 and is valid to October 15, 2029. You can verify it in Schellman's directory.
What is the difference between ISO 27001 and SOC 2?
A SOC 2 Type II report tests whether specific security controls worked over a twelve-month period. ISO/IEC 27001 certifies the management system that finds and treats security risks between audits. Filed has both, and Schellman audits both every year.
Does Filed use client tax data to train AI models?
No. Filed never uses client data to train AI models and never shares it across firms. The AI providers Filed uses, OpenAI, Anthropic and Google, process data under zero data retention terms, so they don't store it after a request. Their documentation is available under NDA.
Where does Filed store client data?
In the United States. Client data is stored and processed on US servers, with backups kept in a separate US region.
Do we need new IRS Section 7216 consents to use Filed?
For most firms, no. Filed acts as your service provider under Section 7216 and uses taxpayer data only to prepare and review your returns, which the regulations allow without new taxpayer consent. Check with your own counsel for your situation.
Does Filed sign a data processing agreement (DPA)?
Yes. Filed's standard DPA covers CCPA, GDPR and UK GDPR. It commits Filed to breach notice within 72 hours, notice before adding a subprocessor, and deletion or return of your data within 60 days of a request. You can request it in our trust portal.
Who are Filed's subprocessors?
All of them are in the US: a US cloud provider for hosting and storage, OpenAI, Anthropic and Google Cloud for AI document processing, Pylon for customer support, and Google Workspace for email and documents. Filed tells customers before adding a new one.
Who at Filed can see our data?
Only people whose role needs it, such as support staff working on an issue you raised. Access is role-based, protected by multi-factor authentication and logged. Inside your firm, the roles you assign decide who sees what.
What happens if there is a security incident?
Filed follows a written incident response plan to detect, contain and fix the issue. If your data is affected, Filed notifies you within 72 hours, as set out in the data processing agreement, and keeps you updated until it is resolved.
Will Filed complete our firm's security questionnaire?
Yes. Send your SIG, CAIQ or in-house questionnaire to security@filed.com and Filed's security team will work through it with your IT team. Most firms also add Filed to the vendor section of their written information security plan (WISP).
How do we report a security vulnerability?
Email security@filed.com with the details. Filed's security team reads every report.
Bring your security questionnaire to the demo.
We will walk your IT lead through the reports, the controls and how data moves through Filed.