SOC 2 · HIPAA · FTC Safeguards · IRS e-file
Keep your business ready for SOC 2, HIPAA, the FTC Safeguards Rule and the IRS e-file security standards, with one set of evidence for all of them. Compliance connects to the systems you use, checks them on a schedule, drafts your policies with AI and shows what is still missing.
Compliance is in build. Names and figures on this page are examples.
Readiness from the evidence on file today.
How client data is backed up and restored.
Daily, encrypted, kept 35 days.
At least once a year; the result is recorded as evidence.
Connects read-only to
Who it’s for
FTC Safeguards Rule
The FTC Safeguards Rule requires every paid preparer to keep a written information security plan, and most small offices have none. Compliance drafts yours and keeps it signed and reviewed.
IRS Publication 5708 is the free outline the plan follows. With Snow AI Tax, the plan is included.
HIPAA Security Rule
Keep the evidence HIPAA asks for current: who has access, encryption, training, vendor agreements and BAAs. Answer the security questionnaires partners send from what is on file.
SOC 2 readiness
Get ready for a SOC 2 examination: controls mapped to the Security criteria, evidence collected as you work, and a read-only view for the CPA firm that audits you.
What it does
Connections
Compliance links to the systems you already use with read-only access, runs its checks on a schedule, and attaches each result to the controls it proves.
Coming Every connection is in build, and each one says so until it works.
Controls
Each control is mapped to every requirement it satisfies, so one piece of evidence counts for SOC 2, HIPAA, the FTC rule and IRS e-file at once. Pick a framework to see its requirements.
| Control | Meets | Status |
|---|---|---|
| MFA on all accountsAccess | SOC 2CC6.1HIPAA§164.312(d)FTC314.4(c)(5) | Passing |
| Encryption at restData | SOC 2CC6.1HIPAA§164.312(a)(2)(iv)FTC314.4(c)(3) | Failing |
| Leavers removed within one working dayPeople | SOC 2CC6.2SOC 2CC6.3HIPAA§164.308(a)(3)(ii)(C)FTC314.4(c)(1) | Failing |
| Written incident response planIncidents | SOC 2CC7.3HIPAA§164.308(a)(6)(ii)FTC314.4(h)Pub 1345report incidents | Passing |
| Security training at hire and yearlyPeople | SOC 2CC1.4SOC 2CC2.2HIPAA§164.308(a)(5)(i)FTC314.4(e) | Needs evidence |
| Written Information Security Plan approvedGovernance | SOC 2CC5.3HIPAA§164.316(a)FTC314.3(a)Pub 1345safeguard taxpayer data | Passing |
| e-file application kept currentTax | Pub 1345update within 30 days of a change | Needs evidence |
7 of 18 controls shown
Policies
Start from a template, answer a few questions about the business, and AI drafts the policy to fit. A named owner approves it, staff sign it, and it comes back for review every year.
Riya Patel is the Qualified Individual and owns this plan. Marcus Lee is responsible for technical safeguards. Dana Ortiz is responsible for people and vendors.
Two-step sign-in on every account. Client data encrypted at rest and in transit. Access granted by role and removed by the next working day when someone leaves.
This plan takes effect on approval by the Qualified Individual and is reviewed every year.
People and training
Onboarding and offboarding checklists, security training records and background-check status for everyone who works for you. When someone leaves, the checks look for any account still open.
| Person | Checklist | Training |
|---|---|---|
| Riya PatelSecurity lead | Onboarding 7/7 | Complete |
| Jordan ReyesTax preparer, seasonal | Onboarding 7/7 | Complete |
| Priya NairSupport · joined 22 Sep 2026 | Onboarding 4/7 | Due by 22 Oct |
| Tom BeckerContractor · left 19 Sep 2026 | Offboarding 3/5 | Not required |
Vendors and risks
Keep each vendor with its own security reports and BAA status. AI and model providers are vendors too, with a note of where your data goes. A simple register scores each risk by likelihood and impact.
↑ ImpactLikelihood →
Trust page and questionnaires
Publish a trust page with the frameworks you are working towards and the documents customers can ask for under NDA. When a security questionnaire arrives, AI answers it from your own controls, policies and vendors, cites each source, and leaves the gaps for a person.
Readiness statuses, not certifications.
Yes. Every staff account requires two-step sign-in, checked every day.
Control: MFA on all accountsDraftedNo evidence found. No penetration test is on file. A person must answer this.
Control: Vulnerability scans and penetration testNeeds a personAuditor view
When it is time for the audit, invite the partner CPA firm. They see your controls, evidence and policies inside the audit window, ask for what they need, and change nothing.
| Request | What they asked for | Status |
|---|---|---|
| ER-03 | Sample of 25 code changes with reviews | Accepted |
| ER-01 | New hires in the period, with start dates | Submitted |
| ER-04 | Incident response tabletop record | Returned with a comment |
| ER-05 | Backup restore test result | Requested |
Try it here
Answer a sample security questionnaire from the evidence on file, open the trust page your customers see, and step into the auditor’s read-only view.
Questionnaire · example
Received 30 Sep 2026 · 7 of 10 questions shown
Answers come only from what is on file: controls, policies, vendors and the auditor view. Where nothing supports an answer, it says so and leaves it for a person. Nothing is exported until each answer is reviewed.
| A | B | C | D | |
|---|---|---|---|---|
| Question | Answer | Sources | Review | |
| 2 | Do you require multi-factor authentication for all workforce accounts? | EmptyYes. Every staff account in Google Workspace, AWS, GitHub and Stripe requires two-step sign-in. This is checked automatically every day. | Control: MFA on all accountsPolicy: Access Control v3 | |
| 3 | Is customer data encrypted at rest? | EmptyYes, with keys held in our own AWS account. Needs review: the automated check is failing today because one database snapshot is not encrypted. | Control: Encryption at rest | |
| 4 | Do you have a written incident response plan? How quickly would you tell us about a breach? | EmptyYes. Our Incident Response policy names an incident lead and the steps. For health information, we notify a covered-entity customer without unreasonable delay and no later than 60 days after discovery, as HIPAA requires of business associates, or sooner where our agreement says so. | Control: Written incident response planPolicy: Incident Response v2 | |
| 5 | Will you sign a Business Associate Agreement? | EmptyYes. We sign a BAA with covered-entity customers before any health information is shared. | Policy: Vendor Management v1Vendor: Amazon Web Services | |
| 6 | Do you perform a yearly penetration test by an independent firm? | EmptyNo evidence found. No penetration test is on file. A person must answer this. | Control: Vulnerability scans and penetration test | |
| 7 | Do you use AI services that process our data? | EmptyYes. AI features run on an AI model through Amazon Bedrock inside our own AWS account, covered by our AWS BAA. Under AWS’s Bedrock terms, prompts and outputs are not used to train models and are not shared with the model provider. | Vendor: AI model, through Amazon Bedrock | |
| 8 | Do you have a SOC 2 report? | EmptyNot yet. We are preparing for a SOC 2 Type I examination by an independent CPA firm. Readiness evidence can be shared under NDA. | Auditor view |
5 drafted2 need a person0 reviewed
Security at
Bookkeeping and tax preparation for small businesses and families.
These are readiness statuses, not certifications. A SOC 2 report can only be issued by a licensed CPA firm.
Shared under a non-disclosure agreement.
Hosted on Amazon Web Services (AWS), which maintains SOC 2 Type II reports.
security@samplebusiness.example
Auditor view · example
The CPA firm performs the examination and issues the report. Compliance prepares the evidence.
Auditors see controls, evidence and policies. They cannot change anything, and every file they open is written to the access log.
Set with the CPA firm. Evidence must show each control in place on this date.
| Request | What they asked for | Due | Status | |
|---|---|---|---|---|
| ER-02 | Quarterly access review, Q3 2026 | 17 Oct 2026 | Requested | |
| ER-03 | Sample of 25 code changes with reviews | 3 Oct 2026 | Accepted | |
| ER-05 | Backup restore test result | 24 Oct 2026 | Requested | |
| ER-06 | Signed risk assessment | 24 Oct 2026 | Requested |
The line we never cross
Compliance prepares the evidence. A licensed CPA firm performs the SOC 2 audit and issues the report.
We are arranging partner CPA firms: licensed, peer reviewed for SOC engagements, and used to small cloud companies and HIPAA. Each must be independent of the clients it audits. The choice of firm is yours, and Compliance never issues or co-signs a report.
What’s included
Inside Snow AI Tax, on its own, or lent to your own software as an API. No figure appears here until it is final.
The written security plan every paid preparer needs, included with the Tax account.
Every framework and every screen, with its own page, its own plan and the Snow AI sign-in.
Lent to your own software, with your account’s own key.
| Capability | Security plan with Tax | Compliance on its own | Compliance API |
|---|---|---|---|
| Written Information Security PlanFrom the IRS Publication 5708 outline | Included | Included | — |
| Policies drafted with AI, with sign-off | The security plan | All seven templates | Included |
| Controls mapped across frameworks | FTC Safeguards and IRS Publication 1345 | All four | All four |
| Connections and automatic checks | — | Included | Included |
| People, vendors and risks | Staff sign-off | Included | — |
| Trust page | — | Included | — |
| Questionnaires answered from evidence | — | Included | Included |
| Auditor view for the CPA firm | — | Included | — |
| From your Snow AI account, once | |||
| Ask, Write and ExtractQuestions, policy drafting, reading uploaded evidence | From the account | From the account | From the account |
| Snow AI sign-in | The same login as Tax | One login for every app on the account | Your account’s own key |
A Snow AI customer never pays for the same thing twice. What you can use is set by your account: if Tax or Documents already gives you Ask, Write or Extract, Compliance uses the same ones and the usage is pooled. A tax firm on Snow AI Tax already has its security plan.
Part of Snow AI
Compliance is one app in the Snow AI family. What your account already has, it uses.
The login that opens Tax, Documents or Invoice opens Compliance too. No second password and no second list of people.
See the appsA tax firm on Snow AI Tax gets its written security plan from Compliance, with the FTC and IRS controls behind it.
About TaxAsk answers from everything your account holds, Write drafts the policies and Extract reads the evidence you upload. Each is included once, for the whole account.
What works with whatQuestions
Something else? Write to support and a person will answer.
No. Only a licensed CPA firm can issue a SOC 2 report: it is the firm’s signed opinion under the AICPA’s attestation standards. Compliance prepares the evidence, shows how ready you are, and gives the firm a read-only view. It never audits, certifies or declares anyone compliant, and your trust page never says certified.
Yes. The FTC Safeguards Rule requires paid tax preparers to keep a written information security plan. IRS Publication 5708 is the IRS’s free outline for one. Compliance drafts your plan from that outline and keeps its sign-offs and yearly review, and it is included with Snow AI Tax.
Four, from one set of evidence: SOC 2 (the Security criteria, CC1 to CC9, first), the HIPAA Security Rule, the FTC Safeguards Rule (16 CFR Part 314) and the IRS e-file security standards in Publication 1345.
AWS through a read-only role created from a CloudFormation template, GitHub, Google Workspace or Microsoft 365, your sign-in provider, an HR system and Stripe. Every link is read-only, and nothing is kept beyond the read-only role and sealed app tokens. None of these is built yet; each one says Coming until it works.
AI drafts them from a template and your answers about the business. Nothing takes effect until the named owner approves it; staff then sign it, every version is kept, and it comes back for review each year. The AI runs through Amazon Bedrock, under Snow AI’s Business Associate Addendum with AWS.
Upload the questionnaire and AI answers each question only from what is on file: your controls, policies, vendors and the auditor view, with the source cited. Where nothing supports an answer, it says so and leaves it for a person. Every answer is reviewed before export.
A licensed CPA firm that you engage directly. We are arranging partner firms, and the choice of firm is yours. The firm must be independent of you, and it signs the report under its own license. Compliance never issues or co-signs a report.
Pricing is being set, and no figure will appear here until it is final. The security plan for tax firms is included with Snow AI Tax. Compliance is in build: Snow AI uses it on itself first, then it opens to customers. A Snow AI customer never pays for the same thing twice.
Compliance is in build. When it opens, it starts from the Snow AI account you already have.
AI assistant · answers from Snow AI’s own pages · not tax, legal or insurance advice