01
The plan is a legal requirement
The FTC Safeguards Rule requires independent tax practices to keep a written information security plan. Verafile produces yours from a guided questionnaire and keeps it current.
For independent tax practices
Your security plan.Your client's identity.Tied together.
Verafile writes and maintains your practice's information security plan, verifies each taxpayer at intake, and links the two. When a return is filed, you can show which controls were in force and that they were applied to that client.
- IRS Publication 4557
- FTC Safeguards Rule
- No taxpayer account needed
Verification record
Taxpayer · Tax year
Verification at intake
- Identity verificationStatus outcome
- PASSED
- Checks performedDocument and biometric
- 2 OF 2
- Plan version in forceAt the time of verification
- V3
- Pre-filing checkWithin the permitted interval
- PASS
Appended to the audit log · SHA-256 hash chained
Illustrative record. Not real taxpayer data.
- The guidance your plan follows
- IRS Pub. 4557
- The rule your plan answers
- FTC Safeguards Rule
- A clear result before you file
- Pass · Fail · Review
- A hash-chained audit log
- SHA-256
Why Verafile
One system for the plan and the proof.
A security plan says what your practice does. A verification record shows that you did it. Verafile keeps both, linked.
02
Refund fraud starts at intake
Fraud enters a practice the moment a new client hands over their details. Verafile confirms the taxpayer's identity at that point, before any work begins.
03
Proof, not just policy
Each verification is recorded against the plan in force, so you can show that your stated controls were applied to a specific client before their return was filed.
How it works
Four steps, from sign-up to a pre-filing result.
Step 01
Set up your practice
Register, invite your staff and give each person the Admin or Preparer role. Your practice's data is visible to your practice alone.
Step 02
Generate your security plan
Answer a guided questionnaire about how your practice works. Verafile turns your answers into a written information security plan, ready to download.
Step 03
Verify the taxpayer
A Preparer starts a verification for a taxpayer and a tax year. The taxpayer completes the identity check, and the record keeps the plan version in force at that moment.
Step 04
Check before you file
Verafile weighs the verification against the plan version it refers to, including how long ago the check took place, and returns a clear result.
Security plan
A written plan, with every version kept.
Your answers and a rule set produce a written information security plan you can download, aligned with IRS Publication 4557 and the FTC Safeguards Rule. Change an answer and you get a new version with its own identifier. Earlier versions are never overwritten.
Written Information Security Plan
Five sections · downloadable
- 01Designated Security Coordinator
- 02Risk Assessment
- 03Safeguards Implementation
- 04Service Provider Oversight
- 05Incident Response
Evidence
What you can show, long after the return is filed.
Every verification is recorded, linked to the plan in force, checked before filing and written to a log that reveals any later change.
01 of 04
Every verification, on the record
Session ID, outcome, checks performed and timestamps.
Each completed session becomes a record. The outcome comes from the identity provider itself: passed, failed, requires review, pending or expired. Verafile never stores the identity documents or biometric files behind it.
Who uses Verafile
Practice Admin
The owner or manager of the practice
Registers the practice, manages the subscription, invites staff and assigns roles. Completes the questionnaire and generates plan versions, and can do everything a Preparer can.
Preparer
A member of the practice's staff
Starts taxpayer verifications, reviews verification records, runs pre-filing checks and reads the plan in force.
Taxpayer
The practice's client
Completes identity verification in a hosted session. No Verafile account, no password.
Data handling
Built for sensitive records from day one.
Verafile holds taxpayer verification records for working tax practices. Encryption, isolation between practices and controlled retention are part of the platform, not add-ons.
- AES-256 encryption at rest
- TLS 1.3 encryption in transit
- Encryption keys held in a managed key service
- Each practice isolated from the others at the database level
- Least-privilege access, with access to sensitive records logged
- Documented retention windows, with automated deletion
- No raw identity documents or selfies stored by Verafile
Pricing
Two plans: one for a solo preparer, one for a practice.
Pay monthly or annually. Each plan includes a verification allowance, and your usage is tracked against it.
Solo
$39/month
Monthly or annual terms. Includes a verification allowance for this tier.
- Written information security plan
- Immutable plan versions
- Taxpayer identity verification
- Pre-filing check and validation history
Practice
$89/month
Monthly or annual terms. Includes a verification allowance for this tier.
- Written information security plan
- Immutable plan versions
- Taxpayer identity verification
- Pre-filing check and validation history
FAQ
Questions practices ask first.
Does the taxpayer need a Verafile account?
No. The taxpayer completes the identity check in a hosted session. They never create a login or an account with Verafile.
Does Verafile store identity documents or selfies?
No. Raw identity documents and biometric files stay with the identity verification provider. Verafile keeps only the session ID, the outcome, the checks performed and the timestamps.
What happens when I change my answers?
You get a new plan version. Every generation is kept as an immutable version with its own identifier, and earlier versions remain retrievable.
What does the pre-filing check tell me?
Pass, fail or review required, for one taxpayer and one tax year. It is an evaluation result, not proof that a tax return was filed.
Which frameworks does the security plan follow?
IRS Publication 4557 and the FTC Safeguards Rule. The plan covers five areas: Designated Security Coordinator, Risk Assessment, Safeguards Implementation, Service Provider Oversight and Incident Response.
Is this legal or compliance advice?
No. Verafile does not give legal or compliance advice on the content of your security plan, and it does not guarantee regulatory compliance.
Get started
Put your plan and your proof in one place.
Register your practice, invite your team and generate your first security plan. Your data stays separate from every other practice.