Your tax file is the most complete dossier that exists on you. We treat it that way.
Identity, income, family, property, health spending, charitable giving, bank details — all in one place. Losing control of it is not an inconvenience for you, it is a permanent problem. Here is exactly what we do about that, and what we will never ask you to do.
Encrypted in transit and at rest
Documents move through a secure client portal over TLS and are stored encrypted. This website itself is served over HTTPS only, with HTTP requests redirected.
Multi-factor authentication
On your portal account and on every system we use that touches client data. A stolen password on its own is not enough to reach anything.
Least-privilege access
Only people who need a file to do the work can open it. Nobody at Xelvon has the ability to move money in your bank accounts, because nobody needs it.
A written security plan
We maintain a Written Information Security Plan as the FTC Safeguards Rule requires of tax preparers and as IRS Publication 4557 sets out. It is reviewed at least annually.
Backups and continuity
Encrypted, redundant backups so a lost device or a failed drive never becomes a lost return, and so your records survive anything that happens to any single machine.
Retention with an end date
We keep returns and supporting workpapers for seven years, then destroy them securely. Data nobody holds any longer is data nobody can lose.
The one rule we will not bend
We will never ask you to email a Social Security number, a bank account number, or a photograph of a tax document — and you should never send one to anybody who does. If a message claiming to be from Xelvon asks for that, it is not from us. Call (435) 341-4014 and tell us.
Ordinary email is not encrypted. It passes through servers you do not control, it sits in an archive that is searchable forever, and it is the single most common way tax data leaks. A W-2 photographed and emailed in February is still sitting in two mailboxes in five years.
So everything sensitive goes through the portal, which takes about the same amount of effort and is a completely different risk. If the portal is genuinely not workable for you, tell us and we will arrange another secure route — including post, if that is what suits you. What we will not do is quietly make an exception because it is faster.
What we are permitted to do with your information
Federal law is unusually strict here, and in your favour. Under Internal Revenue Code section 7216, a tax return preparer commits a criminal offence by knowingly or recklessly using or disclosing your tax return information for any purpose other than preparing your return, unless you have signed a separate, specific consent first.
That means we cannot pass your information to a lender, a partner, a financial adviser or a university financial aid office without your written consent, and we cannot even use it to market our own other services to you without one. Consent is always a separate document, never buried inside an engagement letter, and refusing has no effect whatsoever on the price, quality or availability of what we do for you. The consent forms and the rules behind them are published in full here.
What we ask of you
Most compromises of tax data do not happen at the preparer. They happen to the taxpayer. A few things make a genuine difference:
- Get an IRS Identity Protection PIN. Any taxpayer can request one from the IRS, and it is the single most effective protection against someone filing a fraudulent return using your Social Security number. It takes a few minutes at irs.gov.
- Use a unique password on your email account, with multi-factor authentication. Your inbox is the master key to everything else. If it falls, so does the rest.
- Assume any unexpected contact is fake. The IRS does not open a conversation by phone, text, email or social media, and it does not demand payment by gift card, wire transfer or cryptocurrency. Ever.
- Verify before you pay us, too. Our bank details do not change. If you receive a message that appears to be from Xelvon asking you to send payment somewhere new, do not act on it — call the number on this website.
How to tell a real message from us
Tax-season impersonation is a large, professional industry, and it gets better every year. Some things that are always true of us:
- Our email always comes from an address ending @xelvontax.com. A lookalike domain is the oldest trick there is — read it carefully.
- We will never threaten you, never create urgency about a payment, and never tell you that something terrible happens in the next hour.
- We will never ask for payment by gift card, cryptocurrency, wire transfer to a personal account, or a peer-to-peer payment app.
- We will never ask you to confirm your Social Security number by replying to an email.
- When in doubt, do not reply. Call (435) 341-4014. We would much rather take a call about a message that turns out to be genuine.
If something does go wrong
No honest firm claims a breach is impossible. What we can commit to is how we would behave.
If client information were compromised, we would contain it, investigate it, and notify the people affected promptly — along with the IRS Stakeholder Liaison and the relevant state authorities, and the Federal Trade Commission where the Safeguards Rule requires it. We would tell you what was taken rather than what was “potentially accessed”, what we were doing about it, and what you should do — including how to place an identity theft indicator on your IRS account. You would hear it from us, and you would hear it quickly.
Found a vulnerability in this website or in how we handle data? Please tell us at security@xelvontax.com. We will acknowledge within two business days and we will not pursue anyone who reports a genuine issue in good faith.
Your rights over your data
You can ask us what we hold about you, ask for a copy, ask us to correct it, and ask us to delete what we are not legally required to keep. Requests go to privacy@xelvontax.com and the full procedure, including verification and timescales, is in the privacy policy.
One honest caveat: professional and tax record-retention duties mean we cannot delete a filed return or its supporting workpapers on request. We will always tell you exactly what we must keep and why, and we destroy it securely once the retention period ends.