Security & your data

Built to be secure, because the stakes are real.

Your clients trust you with their Social Security numbers, bank accounts and income. Delvio is built to keep that trust, by a practicing CPA who carries the same IRS Publication 4557 and FTC Safeguards Rule obligations you do.

One rule governs this page: nothing here reads as live unless it is live. What's protecting your data today is written in the present tense; what ships at launch says so plainly.

Protecting your data today

Multi-factor authentication, required

Every login requires multi-factor authentication. Not offered, not recommended: required, for every account.

An audit trail

Delvio records who viewed and who changed each client record and return, and when.

Encrypted in transit

All traffic between your browser and Delvio is encrypted with TLS 1.3. There is no unencrypted path to client data.

Encrypted at rest

All client data is stored encrypted, and SSNs and bank account numbers get an extra layer of encryption of their own. And because Delvio is web-based, there's no local client file sitting on an office PC waiting to walk out the door.

Only the tax app can read an SSN

SSNs and bank account numbers are encrypted field by field, and only the tax software holds the keys. The portal, scheduler and check-in never see a full SSN. Inside the tax software, client lists show only the last four digits; the full number appears only when a preparer clicks Show.

Your firm's data is yours alone

Every request is checked against your firm and the specific client being accessed. Firms are fully isolated from one another — your people see your clients, and nobody else's.

You own your data

Your client data belongs to your firm, not to us. You can export it — Delvio is not a place your practice gets locked into.

Report an issue instantly

Built-in one-click reporting routes problems straight to the people who fix them — including anything that looks like a security concern.

A written security program, with an incident-response plan

Delvio operates under a written information security program, adopted October 2026, as the FTC Safeguards Rule requires. Its incident-response plan covers detection and containment, and commits us to notify affected offices within 72 hours of discovering an incident.

SOC 2 Type II–audited hosting

Delvio runs on Render and Supabase (on AWS), both independently audited under SOC 2 Type II. Client data stays in U.S. data centers only.

Daily backups, tested restores

Client data is backed up every day, and restores are tested. A backup that's never been restored is a hope, not a plan.

Authorized IRS e-file Provider

Delvio Tax is authorized by the IRS as an e-file Software Developer and Transmitter.

Taxpayer privacy under IRC §7216

Taxpayer return information is handled under IRC §7216, the federal law that limits how it may be used and disclosed.

Built by a CPA firm

Delvio comes from a CPA firm that practices under Treasury Circular 230. We carry the same professional obligations you do.

Committed for launch

These protections are part of Delvio's launch to other firms. None of them is optional, and none will be deferred past launch.

  • A security summary you can hand to anyone

    At launch, a plain-English customer security summary you can give a client, a partner, or a reviewer who asks how their data is protected.

Questions about security, or a specific requirement for your firm — a WISP review, a due-diligence questionnaire, an insurer's checklist? Get in touch. You'll be talking to the CPA who built it.