Firm-level data isolation
Every record belongs to one firm, and the database itself enforces that a firm can only read its own rows.
Security by design
How Firmstead protects client information.
Firmstead requires multi-factor authentication for staff, encrypts client information in transit and at rest, isolates each firm’s data at the database level, and records an audit trail of who viewed, changed, downloaded or shared sensitive data. It also gives firms the records they need for a written information security program under the FTC Safeguards Rule.
Security by design
Protect the confidence your clients place in you.
Security shouldn’t be a collection of promises. Firmstead gives small firms practical controls, clear evidence, and fewer places for sensitive data to hide.
FTC Safeguards readyControls and evidence designed for your WISP
Multi-factor authentication
MFA is required for every staff account, and enrollment status is visible at a glance.
Encryption everywhere
Client information is encrypted in transit and at rest.
Complete audit log
Know who viewed, changed, downloaded, or shared sensitive data.
Quarterly access reviews
Confirm or revoke access with a documented owner sign-off.
Controls in detail
Field-level encryption for sensitive data
Social Security numbers, dates of birth, account numbers, authenticator secrets and integration credentials are encrypted individually, each with its own data key.
Step-up verification
Revealing an SSN, downloading restricted files, exporting data, deleting records and changing security settings all require the user to re-authenticate first.
Role-based permissions
Owners, preparers and contractors get different permissions, and access can be limited to specific service lines.
Tamper-evident audit trail
Each audit event is chained to the one before it, so editing or deleting history is detectable.
Safe file handling
Uploads are type-checked and virus-scanned, stored under random names, and downloaded only through short-lived signed links.
Email without client data
Notification emails carry a link back into Firmstead, never the client’s information itself.
Safeguards Rule program tools
Incident tracking, emergency contacts, vendor oversight, tabletop exercises and a WISP workspace help you document your program under the FTC Safeguards Rule.
Found a security issue? Email hello@firmstead.app and we will respond promptly.