Wardstep
Security

How Wardstep protects your data

The FTC Safeguards Rule asks tax offices to oversee the service providers that handle their information. This page lists what we do, so you can check us the way your plan says you should.

What we store, and what we don't

  • We store your firm's security plan: checklist answers, inventory, staff names and emails, training results, sign-offs, review dates, incident notes and the evidence files you upload.
  • We never ask for client tax data. There's no place in Wardstep to enter a client's name, Social Security number, return or bank details, and we ask you not to upload files that show them.

Sign-in

  • Every account must use an authenticator app (multi-factor authentication). Your firm's data isn't readable until the second step is done.
  • Passwords must be at least 12 characters, and changing a password requires recent sign-in.
  • Email addresses are confirmed before an account can be used.

Isolation between firms

  • Access rules live in the database itself (row-level security): every record is visible only to members of its firm, and only in a session that completed multi-factor sign-in.
  • An automated test suite tries to read and change other firms' data, and to act without multi-factor sign-in. Every attempt must fail before we release.
  • Evidence files are stored privately under your firm, follow the same rules, and open through links that expire after one minute.

Staff training links

  • Each link belongs to one person, expires after 30 days, and can be turned off at any time. A new link replaces the old one.
  • We store only a one-way fingerprint (hash) of each link, so even our own database can't be used to rebuild working links.
  • Quizzes are graded on our server, so the training log is a record you can rely on.

Infrastructure

  • Data is stored with Supabase in the United States (US East) and encrypted in transit and at rest.
  • The app is served by Cloudflare over HTTPS only, with strict security headers that block injected scripts and framing.
  • Account emails come from wardstep.com, authenticated with SPF, DKIM and DMARC.
  • No ads, analytics trackers or third-party scripts run on our site or app.

Reporting a security issue

If you think you've found a vulnerability, email hello@wardstep.com. We'll respond promptly and work with you in good faith.