AI Security & Client Data Protection
Powerful AI. Professional-Grade Protection.
MAX brings artificial intelligence into your practice to help you understand clients, uncover opportunities, automate routine work, and deliver more valuable services.
But not at the expense of confidentiality.
We've built additional privacy protections into supported MAX workflows to help safeguard sensitive client information before it is processed by external AI models.
Sensitive Information Masked Before AI Processing
MAX uses an advanced privacy protection layer that identifies sensitive personal and financial information and replaces supported identifiers with secure tokens before information is submitted to external AI models.
Depending on the information and workflow, protected data may include:
- Social Security numbers (SSNs) and Individual Taxpayer Identification Numbers (ITINs)
- Employer Identification Numbers (EINs)
- Bank account and routing numbers
- Client names
- Mailing and physical addresses
- Dates of birth
- Telephone numbers and email addresses
- Other sensitive personal and financial identifiers
This allows MAX to perform supported analysis and generate useful insights while reducing unnecessary exposure of identifying information.
Your clients' identities deserve protection—even when AI is doing the work.
Secure Tokenization & Controlled Data Handling
When supported information is masked, sensitive identifiers are replaced with tokens that can be used during AI processing.
The original information and its corresponding token references are handled within the CountingWorks-controlled environment, supported by our AWS cloud infrastructure and applicable access controls.
Where necessary for an authorized workflow, protected information can be associated with its original values without unnecessarily exposing those values to external AI models.
Your Client Data Is Not Used to Train Public AI Models
CountingWorks does not authorize AI model providers acting on our behalf to use Customer Data submitted through MAX to train their public foundation models.
Your client information is processed to provide the services you use—not to train public AI models.
Independently connected third-party applications and services may operate under their own privacy and data-use policies. Firms control which available external connections they authorize.
Human Intelligence Remains in Control
MAX is built to enhance professional expertise, not replace it.
Whether identifying advisory opportunities, analyzing client information, drafting communications, or executing authorized automations, MAX operates within the permissions and capabilities of the platform.
Firms remain responsible for professional review and appropriate oversight of AI-generated recommendations and actions.
Smarter automation. Stronger privacy. Professional control.
Learn more in our MAX AI & Data Use Notice.
Secure Cloud Infrastructure
Powered by Amazon Web Services (AWS)
CountingWorks PRO is hosted on Amazon Web Services (AWS), one of the world's leading cloud infrastructure providers, trusted by financial institutions, enterprises, and government organizations.
AWS provides a foundation of globally recognized security and infrastructure controls.
Our AWS infrastructure benefits include:
- Recognized security standards: AWS infrastructure supports internationally recognized standards and certifications, including ISO 27001, SOC 2 Type II, and applicable FedRAMP authorizations.
- Infrastructure resilience: Cloud redundancy, backup capabilities, and disaster recovery safeguards.
- Network protection: Firewalls, DDoS mitigation, and layered network security controls.
- Encrypted storage: AWS storage services, including encrypted S3 and RDS resources.
- Physical security: Data center facilities protected by AWS physical access controls and continuous infrastructure monitoring.
CountingWorks PRO uses U.S.-based AWS infrastructure for its primary platform data storage.
AWS's shared responsibility model combines cloud infrastructure security with application and data safeguards managed by CountingWorks.
Encryption & Data Security
Protection at Every Layer
Sensitive financial information deserves protection during transmission, storage, and authorized use.
CountingWorks PRO applies multiple layers of data security.
Encryption in Transit
Connections to the CountingWorks PRO platform are protected using HTTPS and modern Transport Layer Security (TLS) protocols, including TLS 1.2 or higher.
Encryption at Rest
Stored files, documents, communications, and application information are protected through encryption at rest, including AES-256 encryption within applicable storage services.
Sensitive Data Protection
Access to sensitive information is restricted to authorized systems, services, and users. Additional masking and tokenization safeguards are applied to supported AI processing workflows.
Secure Backup & Recovery
Our AWS infrastructure supports encrypted backups, snapshots, and data recovery processes designed to protect business continuity and data integrity.
Application Security & Access Controls
The Right Information. The Right People.
CountingWorks PRO incorporates security controls designed to help firms manage access to confidential client information.
These include:
- Role-based access controls: Permissions help restrict access to authorized users and appropriate platform functions.
- Multi-factor authentication: MFA protects administrative environments and is available for firm accounts.
- Secure session management: Authentication and session controls help reduce unauthorized account access.
- Activity and audit logging: Platform activity records support monitoring, troubleshooting, and accountability.
- Controlled administrative access: Internal access to production systems and sensitive information is limited according to operational responsibilities.
We encourage firms to apply appropriate user permissions and regularly review access as staff responsibilities change.
Network Security & Threat Protection
Multiple Layers of Defense
CountingWorks PRO uses cloud and application security controls designed to reduce exposure to common internet-based threats.
Our protections include:
- Content delivery networks (CDNs), including services such as Cloudflare
- DDoS mitigation and traffic filtering
- Network and application firewall controls
- Bot detection and suspicious-traffic management
- Secure HTTPS connections
- Rate limiting and request throttling where appropriate
- Infrastructure monitoring and security alerting
Our content delivery infrastructure also helps provide reliable website and application performance for firms and their clients.
Continuous Monitoring & Secure Development
Security Is an Ongoing Commitment
Security is not a one-time project. It requires monitoring, assessment, maintenance, and continuous improvement.
CountingWorks PRO incorporates security practices throughout platform development and operations.
Our approach includes:
Vulnerability Management
Identifying and evaluating potential vulnerabilities in infrastructure, software dependencies, and application components.
Security Testing
Internal security reviews, vulnerability assessments, and third-party security testing support ongoing identification of potential risks.
Secure Application Development
Code reviews, testing, and application safeguards informed by recognized practices, including the OWASP Top 10.
Infrastructure Monitoring
AWS monitoring and security tools, including services such as GuardDuty and Security Hub, support detection and investigation of potential threats.
Ongoing Platform Maintenance
Application updates, security improvements, and technology maintenance help protect the reliability and integrity of the platform.
Our objective is to identify and address security risks proactively while continuously improving platform resilience.
Built for Tax & Accounting Professionals
Security That Understands Your Responsibilities
Tax and accounting professionals operate under confidentiality obligations that extend beyond those of many ordinary businesses.
CountingWorks PRO is designed with those responsibilities in mind.
Our security and privacy approach supports firms working to meet applicable requirements and guidance, including:
- IRS Publication 4557 — Safeguarding Taxpayer Data
- The FTC Safeguards Rule, where applicable
- Internal Revenue Code Section 7216 and applicable taxpayer confidentiality requirements
- Applicable state privacy and data protection requirements, including California privacy laws
The platform's security controls can help firms protect confidential information while supporting their own internal compliance programs.
Individual firms remain responsible for determining applicable professional obligations, managing authorized access, and obtaining any legally required consents for particular uses or disclosures of client information.
For additional information, please review our Privacy Policy, Data Processing Addendum, and MAX AI & Data Use Notice.
Incident Response & Business Continuity
Prepared to Respond
CountingWorks maintains incident response procedures designed to identify, investigate, contain, and address potential security incidents.
Our approach includes:
- Monitoring and evaluating potential security events
- Investigating suspected unauthorized activity
- Containing identified threats
- Taking appropriate corrective and remediation measures
- Communicating with affected customers as required by applicable law and contractual obligations
- Reviewing incidents to identify opportunities for improvement
Our cloud infrastructure, backup capabilities, and operational recovery procedures are designed to support service resilience and business continuity.
To report a potential security vulnerability or concern, contact security@countingworkspro.com.
Security Is a Shared Responsibility
Your Firm Controls Access. We Help Protect the Platform.
Keeping client information secure works best when technology safeguards and responsible professional practices work together.
We encourage every CountingWorks PRO firm to:
- Enable multi-factor authentication where available
- Use strong, unique passwords
- Assign permissions appropriate to each employee's responsibilities
- Review user access when team members join, change roles, or leave
- Use secure client communication and document-sharing features
- Review connected third-party applications and their permissions
- Maintain appropriate professional oversight of AI-generated work
Together, these practices help build a stronger security environment for your firm and the clients who depend on you.
Your Clients' Trust Is Worth Protecting.
Modern Technology. Responsible AI. Security by Design.
CountingWorks PRO combines secure cloud infrastructure, advanced AI privacy safeguards, and tools built specifically for the needs of tax and accounting professionals.
We believe technology should help your firm grow, operate more efficiently, and deliver better client experiences—without compromising the responsibility you have to protect confidential information.
That's our approach to security. And it's built into the platform.
Have Security Questions?
For information about our security practices, AWS infrastructure, privacy policies, or available security documentation, contact: help@countingworkspro.com
Related Resources: