Tax identity theft is one of the fastest-growing categories of identity crime in the United States. A stolen tax return contains everything a criminal needs to open credit cards, drain bank accounts, file a fraudulent return in your name, and collect your refund before you even know it's gone. The IRS received over 294,000 confirmed identity theft reports in a single recent year - and most victims had no idea their information had been compromised until an attempt to file their own return was rejected.
The question isn't whether your tax preparer takes security seriously. The question is whether they can show you exactly how. "We take security seriously" is something every firm says. What matters is the specific architecture - where your data lives, who can access it, how it's transmitted, and what happens if something goes wrong. Every answer below is specific, documented, and verifiable.
Your Data Doesn't Live
in Someone Else's
Cloud. It Lives Here.
The standard model at most tax preparation firms is cloud-dependent: your documents flow through a cloud CRM, cloud storage, cloud portal, and cloud backup - each one a potential breach point that the firm does not directly control. Griffin & Johnson operates on a fundamentally different architecture. Your tax documents are stored on encrypted, office-controlled hardware - not on a third-party cloud server in a data center we've never seen. Only the intake portal and notification system touch the internet. Your actual taxpayer data lives on-premise, under our direct control, physically located in our office.
When you submit your intake form or upload your documents, the data passes through an encrypted transmission layer and is immediately routed to our local, office-controlled encrypted storage system. It does not sit on a third-party server. It does not live in a public cloud environment. It is not accessible from the internet once received.
Every document you send us - your W-2s, 1099s, K-1s, and supporting materials - is stored on hardware we physically control, encrypted at rest, and accessible only to authorized staff members with individually assigned credentials. No shared logins. No generic accounts. Every access is attributed to a specific person.
The tracking number assigned to your intake - a structured identifier that ties your documents to your office, your tax year, and your file - ensures that nothing gets lost, misfiled, or mixed with another client's records. Every document has a known location, a known access history, and a known chain of custody.
This architecture isn't just more secure. It means you own your data in a way that cloud-dependent firms cannot offer. We don't need to request your records back from a third-party service when you ask for them. We hold them. We control them. And we protect them under a written, IRS-mandated security policy reviewed annually.
Not "We Take Security Seriously."
Here Is Exactly What That Means.
Every measure below is documented in our Written Information Security Plan, reviewed annually per IRS requirements, and enforced through employee training, technical controls, and accountable policy. This is the specific list - not a marketing summary.
The IRS Requires Every
Tax Professional to Have
a Written Security Plan.
Most Never Show It.
The IRS mandates that all tax professionals who handle taxpayer data maintain a Written Information Security Plan (WISP) - a formal, documented policy covering how client data is collected, stored, transmitted, and protected. Our WISP was last reviewed December 30, 2025. Next scheduled annual review: December 30, 2026. It is available to clients upon request.
Our Written Information Security Plan is available to clients upon request with consent of the Data Security Coordinator. It is not a summary - it is the complete, operative document. If you would like to review it before engaging our services, contact us and we will make it available. We consider transparency about security practices to be a basic obligation to our clients - not a disclosure we make reluctantly.
What You Are Entitled
to Expect From Us -
Every Time, Without Asking
These aren't aspirational commitments. They're operational requirements built into our security policy and our daily practice. If we ever fall short of any of these, you have the right to say so - and we have the obligation to address it.
Your data is protected by documented policy - not individual judgment
The measures that protect your information are written, trained on, enforced, and reviewed annually. Security doesn't depend on any individual employee remembering to do the right thing. It's built into the system.
Your PII is never shared without your written authorization
No client information leaves this firm without authentication of the receiving party and your written consent - except as required by law for tax filing purposes. Your data is not sold, shared with marketing partners, or used for any purpose beyond preparing your return.
You will be notified immediately in the event of a security incident
Our incident response protocol requires client notification per Gramm-Leach-Bliley Act provisions. If something goes wrong, you hear it from us first - not from a news report or an IRS notice.
You can request our Written Information Security Plan
The complete WISP is available to clients on request. You don't have to take our word for any of this. The document that governs our security practices is a readable, specific policy - not a legal document designed to obscure rather than explain.
Your records are yours - and accessible when you need them
Because your data is stored on our own controlled systems rather than a third-party cloud, you can request your records and receive them directly from us - without waiting for a third-party service to respond, locate the data, or release it.
Your records are securely destroyed when retention periods expire
We do not retain your data indefinitely. Paper records containing PII are shredded. Electronic records are securely deleted. Your information isn't sitting in an archive somewhere that we've lost track of. Retention and destruction are scheduled, documented, and followed.
If Something Doesn't
Feel Right - Ask Us Directly
🚨 If You Suspect a Security Issue
If you believe your information may have been compromised - whether from our firm or from any other source - contact us immediately. Our Data Security Coordinator will assess the situation and coordinate any required notifications.
- -Call us directly: (757) 814-0535 (Williamsburg) or (703) 867-2920 (Arlington)
- -Email: [email protected]
- -All security inquiries are handled by our designated Data Security Coordinator
- -Response within one business day - sooner for urgent matters
📋 To Request Our WISP or Security Documentation
Our Written Information Security Plan is available to clients upon request with Data Security Coordinator consent. If you have specific questions about our security architecture, data retention practices, or incident response procedures, we will answer them directly.
- -WISP available on request - the complete document, not a summary
- -Specific security questions answered directly, not redirected
- -Third-party service provider security information available upon request
- -Annual review schedule and last review date publicly disclosed on this page
Security You Can
Verify. Not Just Trust.
Submit your intake form and we'll reach out within one business day. Your documents enter an encrypted transmission layer the moment you submit them - and they never leave our controlled systems from that point forward.