Security & data

• TaxFlow holds leads, messages and bookings. That’s it.
• SSNs, SINs, tax returns and tax documents never go into TaxFlow.
• Card payments are handled by Stripe. We never see full card numbers.
• You own your data. You can export it or ask us to delete it.

TaxFlow is built to win and book clients. It stores only what that needs:

• Contact details: name, email, phone number and the firm or business name.
• What the prospect asked for, such as “1040 and a side business.”
• Text, email and chat messages between your firm and the prospect.
• Appointments, reminders and their status.
• Where the lead came from, such as an ad or your Google profile.
• Proposal and payment status, and review or referral requests sent.

These never go into TaxFlow:

• Social Security Numbers (SSNs) or Social Insurance Numbers (SINs).
• Tax returns, W-2s, 1099s, T4s or any other tax documents.
• Bank account numbers or copies of ID.

Our forms never ask for them. If a client sends one by text or email anyway, delete it and point them to your secure client portal. Sensitive files belong in the practice software you already use, such as TaxDome, Karbon, Canopy or SmartVault.

TaxFlow runs on established cloud infrastructure in the United States. Data is encrypted in transit (HTTPS / TLS). Our own website and records are stored with reputable hosting providers.

We use trusted providers for email, text messaging, calendars and payments. They only process data to provide their service to us.

If you prepare tax returns in the US, Internal Revenue Code §7216 and its regulations limit how you can use or disclose information you got while preparing a return. Using it for marketing, such as review requests, referral asks or next-season reactivation, generally needs the client’s prior written consent in the form the regulations require.

Before you load past clients into TaxFlow for these campaigns, get that consent. Your firm is responsible for it. We can help you build a consent step into onboarding.

In Canada, follow PIPEDA or your provincial privacy law and your professional body’s rules. For marketing messages, CASL applies.

This is general information, not legal advice. Ask your own advisor about your situation.

Our forms ask leads for permission to contact them by text and email. Every text message lets people reply STOP to opt out, and opt-outs are honored automatically. Only message people who have agreed to hear from you.

Card payments, both yours to us and your clients’ to you through TaxFlow, are processed by Stripe, a PCI DSS certified payment processor. We never see or store full card numbers.

• Each person on your team gets their own TaxFlow login. No shared passwords.
• You decide who on your team has access, and can remove it at any time.
• At Multidex, only the people working on your account can access it.
• Ask us any time who has access to your account.

Your firm’s data belongs to you. You can export your contacts at any time, or ask us to do it for you.

To delete a contact, your whole account, or your own record as a website visitor, email hello@multidextech.com. We will confirm when it’s done, within any deadline the law sets.

If we learn of a security incident that affects your data, we will tell you without undue delay, explain what happened and what we are doing about it, and notify authorities where the law requires.

Security questions or a concern to report: email hello@multidextech.com. See also our Privacy Policy and Terms of Service.