If your firm prepares tax returns in the US, the Federal Trade Commission's Safeguards Rule sets out how you protect the client information you hold. Its scope names tax preparation firms among the financial institutions it covers (16 CFR 314.1(b)), and since the 2021 amendments it spells out specific controls. Several of them meet at one moment: when a client file leaves your desk, to a client for review, to a lender with a set of accounts, or from a client sending in their statements.
This checklist goes through the parts of the rule that touch file sharing, quotes what each asks, and says what 99 Data Rooms does for it. For UK firms, our secure file sharing for accountants comparison covers the UK options.
Quick answer
| What the rule asks | Where in 16 CFR 314 | What 99 Data Rooms does |
|---|---|---|
| Encrypt customer information in transit and at rest | 314.4(c)(3) | AES-256 at rest and TLS 1.2 or higher in transit, on every plan |
| Multi-factor authentication for anyone accessing your systems | 314.4(c)(5) | Two-factor sign-in with an authenticator app and recovery codes, on every plan |
| Access only for authorised users, limited to what they need | 314.4(c)(1) | Each link opens only what you put behind it; a verified email with a one-time code, a passcode, an expiry or a view limit from Plus; revoke any link in one click on every plan |
| Monitor and log authorised users' activity | 314.4(c)(8) | A visit log for every share link, kept 24 months; page-by-page detail from Plus |
| Oversee your service providers, by contract | 314.4(f) | A published Data Processing Addendum and sub-processor register |
Who the rule covers
The rule applies to the financial institutions the FTC oversees, and its list names "tax preparation firms" alongside "credit counselors and other financial advisors" (16 CFR 314.1(b)). It covers "all customer information in your possession", not only information about people who are your customers today.
A firm that holds customer information on fewer than five thousand consumers is exempt from four parts: the written risk assessment, continuous monitoring or annual penetration testing, the written incident response plan and the annual report to the board (16 CFR 314.6). Encryption, multi-factor sign-in, access controls and activity logging apply whatever your size.
Encryption in transit and at rest
The rule asks you to "protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest" (16 CFR 314.4(c)(3)). A shared link helps by design: the file is read from one encrypted place rather than copied into every inbox it is sent to.
In 99 Data Rooms, files are encrypted at rest with AES-256 and travel over TLS 1.2 or higher. They are hosted in London, with encrypted backups in an EU region. The rule asks for encryption and safeguards rather than a location, so check any client contract that names one.
Multi-factor sign-in
The rule asks you to "implement multi-factor authentication for any individual accessing any information system", unless your Qualified Individual approves an equivalent or stronger control in writing (16 CFR 314.4(c)(5)).
Every 99 Data Rooms plan includes two-factor sign-in with an authenticator app and recovery codes. Once you turn it on, a session signed in with a password alone cannot read your documents: the check runs in the database, not only in the app.
Your clients count too: the rule's authorised users include "any employee, contractor, agent, customer, or other person" with access to your systems or data (16 CFR 314.2(a)). From Plus, a link can ask whoever opens it to confirm a six-digit code sent to their email before the first page.
Access only for those who need it
The rule asks you to "limit authorized users' access only to customer information that they need to perform their duties and functions, or, in the case of customers, to access their own information" (16 CFR 314.4(c)(1)(ii)).
- Each share link opens only what you put behind it: one document, or one room.
- Members of a room have roles on every plan (viewer, viewer with download, contributor, admin), so each person gets the access their work needs.
- From Plus, a link can carry a passcode, an expiry date or a view limit.
- Revoke a link and it closes everywhere, including for someone reading at that moment. Revocation is on every plan.
A log of who opened what
The rule asks for controls "designed to monitor and log the activity of authorized users and detect unauthorized access or use of, or tampering with, customer information by such users" (16 CFR 314.4(c)(8)).
Every share link in 99 Data Rooms keeps a visit log for 24 months, visible in your own analytics. Each visit's time and completion are recorded on every plan; from Plus, you see page by page what each person read and for how long. Every document you share is also watermarked by default, on every plan, with the viewer's email where the link collects one, a code for that visit and the time, so a copy that leaves can be traced to the visit it came from. Documents signed in 99 Data Rooms carry an audit certificate of who signed, when, from where and how they were verified.
Choosing the provider
The rule asks you to oversee service providers by "taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards", by "requiring your service providers by contract to implement and maintain such safeguards" and by assessing them periodically (16 CFR 314.4(f)).
99 Data Rooms publishes its Data Processing Addendum and its sub-processor register, so you can read the contract terms and see who processes your data before you sign up. It runs on SOC 2 Type II and ISO 27001 audited platforms from our infrastructure providers, Supabase and Cloudflare; the security page has the detail.
What stays with your firm
A file-sharing tool carries controls; the program around them is yours. The rule asks you to designate a Qualified Individual, and you "retain responsibility for compliance" even where a provider fills that role (16 CFR 314.4(a)). The program itself rests on a risk assessment (314.4(b)), and it includes an incident response plan (314.4(h)) and a notice to the FTC within 30 days of discovering a notification event that involves the information of at least 500 consumers (314.4(j)).
Start with the controls above for the files you share most, such as returns sent for review, statements collected each season and accounts sent to lenders, then record in your written program which tool carries which control.
Sources
- 16 CFR Part 314, Standards for Safeguarding Customer Information, as published in the Electronic Code of Federal Regulations (the version of 13 May 2024).
Its scope names tax preparation firms (16 CFR 314.1(b)). A firm holding customer information on fewer than five thousand consumers is exempt from the written risk assessment, continuous monitoring or annual penetration testing, the written incident response plan and the annual report to the board (16 CFR 314.6). Encryption, multi-factor sign-in, access controls and activity logging still apply.
In London, in the UK, encrypted at rest with AES-256, with encrypted backups in an EU region. The Safeguards Rule asks for encryption and safeguards rather than a location (16 CFR 314.4(c)(3)), so check any client contract that names one.
No. They open the link in their browser. From Plus, you can ask them to confirm a six-digit code sent to their email first, so you know who opened it.