Where files are kept
Files are stored with Amazon Web Services in the United States. The app and its database run on our own servers in the United States, behind Cloudflare. Neither the database nor the file storage can be reached from the internet directly.
Encryption
- Every page, upload and download uses HTTPS, and browsers are told to use nothing else.
- Files are encrypted while stored, with keys managed by Amazon Web Services.
- Nightly database backups are encrypted, and we have tested restoring one.
Every file checked for viruses
Each file is scanned by Amazon's malware scanner as it arrives. Until the scan is done, nobody can open or download it. A file that fails the check is never offered to your team: the document goes back to Missing and your client is asked to send it again.
Your firm's data stays yours
Every client, request and file belongs to one firm, and every page checks that before showing anything. Automated tests try every page of the app as someone from another firm, and as someone signed out, before any change goes live.
A private link for each client
- Each person on a request gets their own long, random link. There is nothing to guess.
- A link shows only that person's request, and stops working when the request is closed.
- Files go straight from your client's browser to encrypted storage, through an address that expires in minutes.
- Your upload page asks for a quick bot check, so it can't be flooded with junk.
Signing in
- Your team signs in with a code sent by email, or a passkey on their phone or computer. A password is optional.
- Sign-in codes expire after 10 minutes and stop working after a few wrong tries.
- Anyone can add an authenticator app as a second step.
- Clients never sign in, so they have no password to reuse or lose.
Who can do what
Each firm has one owner. The owner invites and removes staff and can download everything; staff work on requests and clients. When someone leaves, the owner removes them and they can no longer sign in. Their requests stay with the firm.
A record of every step
Requestpack keeps a record of who sent, opened, uploaded and accepted what, and when, along with sign-ins and team changes.
Our access
We don't look at your clients or their files. We reach your account only to keep the service running or to help when you ask, and only for as long as that takes.
Deleting
- A deleted request or file can be restored for 30 days, then it is removed for good.
- If you cancel, you can download everything first. Thirty days after your plan ends, your firm and all its files are deleted.
For your firm's security plan
Under the FTC Safeguards Rule, accounting and tax firms keep a written information security plan and oversee the service providers that handle client information. You can list Requestpack as one. Our Data Processing Addendum sets out what we commit to, and our sub-processors are listed in full.
Reporting a problem
If you think you have found a security problem, email [email protected] with the details. We will reply within 2 business days and keep you told until it is fixed. Please don't access other people's data or disrupt the service while testing.