Security at CPA Hub
CPA firms handle Social Security numbers, financial records, and the details behind every return. We built CPA Hub knowing that protecting that data isn't a feature to bolt on later — it's the foundation the whole platform stands on. Here's how we approach it, in plain terms.
We don't only grade ourselves.
CPA Hub is scanned by the Mozilla Observatory — an independent, automated assessment of a website's security configuration — and earns a grade of A+, at the top of the scale and well above what's typical for platforms in our space.
To be precise about what that means: the Observatory evaluates how a web application is configured to defend against common browser-based attacks. It's one rigorous, third-party signal of security discipline — not a substitute for a full security audit, and we don't present it as one. We report it because it's objective, repeatable, and not something we can grade in our own favor.
Protecting your data
Sensitive information is protected both while it moves and while it's stored.
Field-level encryption
The most sensitive identifiers are encrypted individually with AES-256-GCM before they're written to the database — so even with database access, these fields stay unreadable without the keys.
- Social Security numbers
- Bank account & routing numbers
- Employer identification numbers
Encryption in transit
All traffic between your browser and our servers is encrypted with industry-standard TLS, so information stays private as it moves.
- HTTPS enforced on all connections
- HSTS (Strict Transport Security)
- Modern cipher suites only
Encryption at rest
Stored data is encrypted at rest on our managed database platform, with sensitive fields carrying the additional field-level layer above.
- Managed database encryption
- Field-level layer for identifiers
- Keys held in the environment, never in the repo
Key management
Encryption keys are handled separately from the data they protect.
- Stored in secured environment configuration
- Rotation-capable
- Never committed to source control
Access & authentication
Strong identity checks and least-privilege permissions.
Multi-factor authentication
- TOTP authenticator apps (Google Authenticator, Authy, etc.)
- Backup codes for recovery
- Can be enforced firm-wide by administrators
Password security
- Minimum 12 characters with complexity requirements
- Hashed with bcrypt — never stored in plain text
- Policy enforced by a dedicated password engine
Role-based access
People see only what their role requires.
- Owner — full control including billing
- Admin — manage firm, users, and clients
- Staff — assigned clients only
Session management
- Short-lived JWT session tokens
- View and terminate active sessions
- Automatic logout on password change
A hardened application
Security lives in how the software is built, not just how it's described.
Application hardening
- Strict security headers (verified by the A+ benchmark above)
- Input validation on data we accept
- Tiered rate limiting to blunt automated abuse
- Disciplined management of third-party dependencies
Database posture
- No public internet access to the database
- Encrypted connections required
- Automated backups on the managed platform
Multi-tenant data separation
Each firm's data is kept separate from every other firm's.
CPA Hub uses a multi-tenant architecture with data access scoped to your firm at the query level. The system is designed so that one firm cannot reach another firm's clients, documents, or settings.
Audit trail
A durable record of security-sensitive activity.
What we log
- Sign-in and sign-out events
- Failed authentication attempts
- Client record and permission changes
- Settings and team-member changes
What each entry captures
- Timestamp with timezone
- User identity and IP address
- Action performed and resource affected
- Before / after values for changes
Compliance, in plain terms
Aligned with the FTC Safeguards Rule — and honest about what that means.
CPA Hub is designed to align with the FTC Safeguards Rule, the federal standard requiring tax and accounting firms to maintain a written information security program. Our tools help firms work toward and document their obligations — including a WISP builder that guides a firm through creating and maintaining its own Written Information Security Plan.
We're deliberate about the language: no software can make a firm "compliant" on its own. Compliance is achieved through a firm's own policies, people, and practices. CPA Hub helps you build, run, and evidence a security program — a tool in service of your compliance, not a guarantee of it. We hold ourselves to the same standard, and maintain our own written information security program.
Reporting a security concern
If you believe you've found a vulnerability in CPA Hub, we want to hear about it. We value responsible disclosure and will work with you in good faith.
[email protected]What we won't promise
No platform — ours or anyone else's — can promise perfect security. What we commit to is diligence: layered defenses, continuous improvement, and a team that treats your clients' data with the seriousness it deserves. If our practices ever fall short, we'll own it and fix it.