Questions & Answers

Our practice is built around regulated professional firms: accounting and tax practices first, and alongside them wealth managers and financial advisors, law firms, mortgage brokers and lenders, and medical, dental and therapy practices. What these firms share is the thing we specialise in: they hold records that clients cannot afford to have exposed and that a regulator can ask about. If your firm holds that kind of data, we speak your language; if you are unsure, ask.

If your firm prepares tax returns or otherwise handles consumer financial data, the Safeguards Rule requires a written information security plan, a named individual responsible for it, a risk assessment, specific technical safeguards such as encryption and MFA, staff training, vendor oversight, and an incident response capability. It is not optional and it is not satisfied by a template nobody has read. Our free WISP Builder shows you the shape of what is required.

If you have a PTIN, yes. The IRS requires paid preparers to have a written data security plan, and Form W-12 asks you to confirm it exists. Beyond the requirement, the WISP is the document you produce when an insurer, a client, or an examiner asks how client data is protected. A plan that no longer describes your firm reads as no plan at all, which is why maintenance matters as much as creation.

IT support keeps systems running; a security function decides what is safe and answers for it. A virtual CISO gives a small firm that function without a full-time hire: a named advisor who knows your environment, sets the security decisions, completes the questionnaires insurers and clients now send, and reviews posture with leadership on a schedule. You keep your existing IT provider. We handle what that provider was never scoped to do.

Possibly nothing, and possibly a serious one, and the difference is where it runs and what goes into it. AI in a personal account processes client data outside your firm's control, outside your retention policy, and outside anything you could show in a review. The same work in a properly configured Microsoft 365 Copilot is not used to train public models.

Microsoft commits to store the prompts and responses in the United States for U.S. tenants. Where the AI runs is a separate question. Microsoft's data protection terms let it process data in the United States or any other country where Microsoft or its subprocessors operate. U.S.-only processing is expected by the end of 2026, not committed. Until Microsoft commits to it and your firm can show who reaches the data, client tax return information goes into Copilot only with each client's consent. We move firms from the first situation to the second without slowing anyone down.

Every engagement is fixed-fee and scoped in writing before work begins: a defined deliverable, a defined price, and a timeline. The number depends on your firm's size band, systems in scope, and how much groundwork exists, which is why it follows a scoping conversation rather than a price list. The conversation itself is thirty minutes and free. The structures are described on our Engagements page.

Yes, and suspected incidents skip the scoping queue. Do not wipe or rebuild anything, preserve logs, note times, and call (414) 301-1017. Evidence of what happened is worth more than a fast cleanup, and the first hours matter. The platform monitors continuously. We review and respond to alerts on a defined business-hours cadence. We do not run a help desk or an around-the-clock response team.

That is a privacy answer to a disclosure question. IRC Section 7216 turns on whether tax return information left your control, not on what the recipient does with it afterward. A vendor that never trains on your data has still received it.

Under 26 CFR 301.7216-2(d)(1), you can share return information without the client's consent only with another tax return preparer located in the United States. The sharing must be to prepare or help prepare the return, and the service must not be a substantive determination. A provider of auxiliary services, and its employees who assist, count as tax return preparers. Location means where the people who receive or view the information are, not where the provider is headquartered. Whether a general-purpose AI tool fits is not settled, and there is no IRS guidance on it.

For Microsoft 365 Copilot, our position is this. Until Microsoft commits to U.S.-only processing and your firm can show who reaches the data, client tax return information goes in only with each client's consent. That consent is under 26 CFR 301.7216-3: a specific signed document, per client, naming the provider, before the disclosure. For Form 1040 clients it follows Rev. Proc. 2013-14. For Form 1040 clients the Social Security number stays out even with consent. Whether a particular disclosure needs consent is a conclusion for your counsel. Nothing here is legal advice.

The agents built in your tenant, plus one free web tool. The Firm Assistant drafts, summarises, and prepares in your firm’s voice: emails, memos, engagement letters, meeting prep, with your disclaimers attached. It is the everyday one, and nothing it writes sends itself. The Morning Brief works in the firm’s own Microsoft 365 Copilot, against each person’s own mailbox and calendar. Staff ask for it in Copilot and read it there. Every chase is drafted in the firm’s voice and held for review, because nothing in a Claremont deployment sends without a person reading it first. Names, dates, and amounts are bolded so the reviewer’s eye lands on them. The Return Reviewer crosswalks a draft return box by box, K-1 to 1040, against the source documents before it is filed. It sorts the differences into variance tiers, the way a reviewer actually checks a return before it goes out. It does not analyze filed returns and does not conclude whether a position is correct. Those three are governed instructions deployed into your own Microsoft 365 Copilot, so they run under your licensing and your tenant's controls. Client tax return information goes into the Return Reviewer only with each client's consent. The Clean Room is the free one: a web tool that strips client identifiers out of anything before it goes near an AI tool you do not control, and it needs no licence. Everything else we build, the cards and the vault, exists to make those three behave the same way every time.

No. Your staff ask Copilot for it and read it in Copilot. The agent cannot send email, by design. With additional Microsoft licensing the agent can also run on a schedule by itself, and we set that up on the retainer once a firm is using the brief daily.

No. Every output is a draft. A person reviews it and a person sends it. Nothing in the Workbench is connected to your mail.

Yes, and verifiably so: the Clean Room, the Readiness Check, the WISP Builder and the other free tools run entirely in your browser. Nothing you type is transmitted or stored by us unless you explicitly choose to send us a report. Each page does record that it was opened, as our Privacy page describes. We built them this way because telling firms to be careful with client data while harvesting theirs would be absurd.

Claremont Security is a Wisconsin firm and works with firms across Wisconsin and the United States. Engagement work is performed remotely by design, and Wisconsin clients can expect in-person availability for the conversations that warrant it.

The first conversation can usually happen within a few business days, and assessment fieldwork begins the day you grant read-only access, normally within two weeks of signing. If you are heading into filing season, say so; we schedule remediation around your calendar, not ours.