Tax-season email that passes the Safeguards Rule.
Clients email you W-2s, 1099s and bank statements all season. The FTC Safeguards Rule (16 CFR 314) and IRS Publication 4557 expect you to encrypt them, control access and keep a written plan. PXCMail encrypts the reply with the W-2 in it and keeps the evidence, on the Gmail or Microsoft 365 account you already have.
14-day trial · Safeguards addendum signed in signup · $49 firm minimum · tax-season onboarding on a call
| Message | Detected | Action |
|---|---|---|
| Re: 2025 docs — W-2 attached | Form W-2 · SSN | Encrypted |
| Draft 1040 for review | Form 1040 | Encrypted |
| Appointment confirmation | — | TLS ✓ |
| FWD: client file → personal gmail | Client NPI | Blocked |
Organizers, W-2s, K-1s, bank letters: the moments we built for.
Tax preparers & enrolled agents
The PTIN WISP question, clients on phones, flat seasonal pricing.
For preparers →Bookkeeping & payroll
Payroll registers, direct-deposit change fraud, per-client archive.
For bookkeepers →Insurance agencies & mortgage brokers
Applications, loan files, NAIC/NYDFS, closing-wire awareness.
For agencies & brokers →The Safeguards Rule, in plain English → · The 12 email questions → · Blog: it’s about your email, not your portal →
What one message goes through
- A client replies with a W-2 attached
Or your staff send a draft return. No one has to remember a button. - Tax-document detection
SSN, EIN/ITIN, W-2/1099/1040 fingerprints, account and routing numbers. - Encrypted automatically
TLS required; tax documents always go with a one-time code — clients open on their phone, no portal account. - Kept seven years
Immutable archive aligned to IRS retention; export for an FTC inquiry or a client dispute.
The season, on one page
W-2 detected → encrypted is the badge your staff will see most.
Mapped to 16 CFR 314.4 — the nine WISP elements
| Safeguards Rule element | PXCMail |
|---|---|
| (a) Qualified individual | Your named coordinator in the console; our Security Officer named in the addendum |
| (b) Risk assessment | Email risk section pre-written for your WISP; annual confirmation letter |
| (c)(1) Access controls | MFA for every user, named accounts, device policies on Hosted |
| (c)(3) Encryption in transit and at rest | TLS enforced + encrypted delivery; AES-256 at rest with your own key on Hosted |
| (c)(5) MFA | Required |
| (c)(6) Disposal | Retention policy; certificate of destruction when you leave |
| (c)(8) Activity logging | Per-message audit trail, exportable |
| (d) Monitoring and testing | Continuous monitoring; annual penetration test SCHEDULED |
| (f) Service providers | Service-provider addendum with security obligations and breach notice |
A downloadable WISP template with the email section completed is part of the design-partner kit.
Works beside your tax software
Drake, Lacerte, ProSeries, UltraTax, CCH, QuickBooks, Canopy, TaxDome. PXCMail is email — anything they send on your behalf can route through Gateway with the same policy.
Insurance agencies and mortgage brokers
Same rule, same product: applications and statements carry the same identifiers.
Pricing
Gateway for accounting
$6 / seat / month billed yearly · $7.50 monthly
Keep Gmail or Microsoft 365. Tax-document detection, encrypted delivery, audit, Safeguards addendum.
Gateway + 7-year archive
$9 / seat / month billed yearly · $11 monthly
Adds immutable 7-year archive and eDiscovery search.
Solo preparers: flat $29/month plan on the roadmap.