DRAFT — requires lawyer review. Not legal advice.
How Dropwarden helps you meet the FTC Safeguards Rule
Last updated: TBD
Accounting, bookkeeping and tax firms are usually "financial institutions" under the Gramm-Leach-Bliley Act (GLBA). The FTC's Standards for Safeguarding Customer Information (the "Safeguards Rule", 16 CFR Part 314) require them to run a written information security program and to oversee the service providers that handle their customers' information.
The Safeguards Rule is your obligation. No vendor can meet it for you, and using Dropwarden does not by itself satisfy it. This page explains which controls the Service gives you, which ones help you meet specific requirements of the Rule, and what remains your responsibility. It is general information, not legal advice. Your Qualified Individual and your advisers decide what your program needs.
Controls the Service gives you
| Safeguards Rule requirement (16 CFR 314.4) | How Dropwarden helps you meet it | What remains your responsibility |
|---|---|---|
| (c)(1) Access controls: let only authorized users access customer information, and only what they need | Roles (owner, admin, member, partner, viewer); per-folder permissions; one folder per client with the Accounting template; partner and viewer accounts limited to assigned folders; upload-only or download-only access; share links with expiry, password and download limits on plans that include them; IP allowlists on plans that include network rules | Decide who needs access; grant the least access needed; review users and permissions periodically (the portal lists every user, role and grant); remove access when staff or clients leave |
| (c)(2) Inventory of data and systems | The portal shows every folder, user and credential in your organization, and the audit log shows where files are and who moved them | Include the Service in your own inventory of systems that hold customer information |
| (c)(3) Encryption in transit and at rest | TLS 1.2 or later for web access; modern SSH ciphers for SFTP; explicit-TLS FTPS only (plain FTP disabled); all stored files encrypted at rest by the storage provider | Make sure clients and staff use the Service (not email attachments) to exchange documents; protect devices where files are downloaded |
| (c)(5) Multi-factor authentication for anyone accessing information systems | TOTP two-factor authentication for portal and web-client users; an owner switch to require 2FA for everyone in the organization; sign-in with Google, Microsoft or your SSO; SSH keys for SFTP | Turn on "require 2FA"; prefer SSH keys over passwords; enforce MFA on your own email and devices |
| (c)(6) Secure disposal of customer information no later than two years after last use (with exceptions), and periodic review of retention | Delete files, folders, users or the whole organization at any time; automations can delete files after a set number of days; on cancellation, data is deleted 90 days after the account is locked, with a deletion confirmation email | Set and follow your retention schedule; configure delete-after automations or delete files yourself; export what you must keep before deleting |
| (c)(7) Change management | Changes to the Service go through reviewed pull requests and automated checks; we announce material changes | Manage changes to your own users, permissions and integrations |
| (c)(8) Monitor and log authorized users' activity and detect unauthorized access | Append-only audit log of every upload, completed download, delete, rename, login (successful and failed) and admin change, with user, time, IP address and protocol; CSV export; audit log streaming on plans that include it; instant or digest notifications on uploads and downloads per folder; alerts when an expected file does not arrive | Review the audit log or notifications regularly; keep exports for as long as your program requires (audit entries are kept for your plan's retention period) |
| (d) Test and monitor the effectiveness of safeguards | Downloadable audit evidence; our Security Overview describes how we scan and patch the Service | Run your own monitoring, vulnerability assessments and penetration tests of your systems as the Rule requires |
| (f) Oversee service providers: select capable providers, require safeguards by contract, assess them periodically | Our Security Overview, Data Processing Addendum (with security measures in Annex II), Subprocessors page with 30 days' change notice, and answers to standard security questionnaires on request at [email protected] |
Review these documents when you select us and periodically afterwards; keep them with your program records |
| (h) Incident response plan | We notify your organization's owners of security incidents affecting your data without undue delay, as described in our DPA, with the facts you need for your own assessment | Include us in your incident response plan; decide whether an incident is a "notification event" for you |
| (j) Notify the FTC within 30 days of discovering a notification event involving the information of 500 or more consumers | Our incident notice and your audit log help you work out what was affected and when | Make the notification to the FTC (and any state notices) yourself |
Requirements only you can meet
The Service does not cover these parts of the Rule: designating a Qualified Individual (314.4(a)), your written risk assessment (314.4(b)), staff training (314.4(e)), evaluating and adjusting your program (314.4(g)), and the Qualified Individual's annual written report to your board or senior officer (314.4(i)).
Tax professionals should also see the IRS guidance on creating a written information security plan (IRS Publications 4557 and 5708) (verify current publication numbers before publishing).
Settings we recommend for accounting and tax firms
- Use the Accounting folder template: one folder per client.
- Turn on Require 2FA for your organization.
- Give clients partner access to their own folder only, or let them upload through the web client.
- Turn on upload and download notifications with a daily digest, so you see every file that arrives and every download.
- Turn on filename redaction in notifications if file names could reveal client information.
- Set a delete-after automation on folders where documents should not be kept indefinitely.
- Export the audit log on a schedule that matches your record-keeping policy.
Limits to be aware of
- Our staff do not look at your files' contents (unless an owner grants a time-boxed support session), so you remain responsible for what is stored and who you share it with.
- The Service runs with a 99.5% uptime target (no high availability). Keep your own copies of records you are required to retain.
- The Service is not intended for payment card numbers. See the Acceptable Use Policy.
Questions: [email protected].