FTC Safeguards Rule · IRS Pub 4557 · WISP
Client PII is sitting in your inbox.
That's a WISP problem.
Your clients will never stop emailing tax documents — and every portal vendor is fighting that. Lightspeed accepts it: each attachment is extracted, classified against 30+ IRS form types, matched to the right client, and archived to an audited vault on your firm's own private server.
½
Up to half your clients still aren't using the portal 90 days after you buy one.
1 in 10
Roughly one in ten clients will never adopt a portal. They will email you, forever.
0
Behavior changes Lightspeed asks of your clients. They keep emailing. We handle the rest.
There is no small-firm exemption.
If you prepare returns, federal data-security rules already bind your practice — solo or not. And the riskiest place taxpayer PII lives in most firms is the one place no WISP mentions: the email inbox.
FTC Safeguards Rule
~$50K+ / violation
Every tax preparer must maintain a written information security plan (WISP), enforce MFA, and report breaches affecting 500+ people within 30 days. Civil penalties run ~$50,000+ per violation — and officers are personally liable up to $10,000 per violation.
IRS Publication 4557
Encrypt in transit
The IRS requires taxpayer data to be encrypted in transmission and covered by access controls. A WISP that ignores email intake is out of step with that guidance — and since 2023, PTIN renewal requires attesting to WISP awareness.
EFIN Revocation
Mid-season shutdown
After a breach, the IRS can suspend or revoke your EFIN — the existential risk for a small practice. No e-filing means no practice, exactly when your clients need you most.
The honest framing
No regulation says "empty your inbox." But PII sitting in email is an unmanaged access-and-retention hole in your WISP. Lightspeed extracts it into an audited vault — a control you can actually write down.
From inbox chaos to an audited vault — automatically.
Your firm gets a dedicated intake address. Everything a client emails there flows through a hardened pipeline — no staff downloading attachments, no guessing what a document is, no wondering what's still missing.
The classifier is explainable, not a black box: every match shows the tokens it found, its confidence, and the identity checks it ran (name, SSN last-4, employer). You can see why — and correct it in one click.
-
01
Client emails, like always
Documents arrive at your firm's dedicated intake address through hardened, signature-verified infrastructure. No logins, no apps, no client training.
-
02
Every attachment extracted & classified
PDFs, scans, and photos are read (with OCR fallback) and identified against 30+ IRS form types with an explainable confidence score.
-
03
Matched to the right client
Name, SSN last-4, and employer signals match each document to the right client and tax year. Unknown senders go to a triage queue with ranked suggestions.
-
04
Checked against what's required
Each return carries a required-documents checklist. Arriving files fill their slots automatically, so "what's still missing?" always has a live answer.
-
05
Missing documents chased for you
Branded reminder emails escalate on your cadence — initial, reminder, final — per filing, automatically, until the documents show up.
-
06
Verified, vaulted, auditable
You verify each document; verified files move to an immutable vault and are wiped from the server. Every file operation is logged with who did what — the audit trail your WISP promises.
Your own private instance.
Not a row in someone's database.
Every Lightspeed firm runs on its own dedicated server with its own database and file store. Your clients' documents are never co-mingled with another firm's data — an isolation story you can tell clients, and an answer you can put in writing when a regulator asks where taxpayer data lives.
- ✓Dedicated server, database & file store per firm
- ✓SSNs stored & displayed last-4 only
- ✓Encrypted credentials, signed webhooks, HTTPS
- ✓Immutable vault + full file-operation audit log
The positioning, plainly
"Every portal vendor fights your clients.
Lightspeed accepts them."
Keep your Canopy, TaxDome, or Drake workflow. Lightspeed is the intake layer in front of it — catching the documents your portal never sees.
Flat per-firm pricing.
Not per seat.
Start where the pain is. Upgrade in place — one setting, no re-boarding, no data migration. Annual prepay gets 2 months free.
Tier 1 · Capture
Get PII out of the inbox. Every emailed document extracted, classified, organized, and vaulted.
- →Email attachment capture on your private instance
- →AI classification against 30+ IRS form types
- →Searchable file list, inspector & full-screen viewer
- →Folder explorer & secure document vault
- →File-operation audit trail
Tier 2 · Organize
Every document lands on the right client, automatically. The intake layer for your existing suite.
- →Everything in Capture, plus:
- →Client boarding via CSV import
- →Automatic file-to-client matching (name, SSN last-4, employer)
- →Unknown-sender triage with ranked suggestions
- →Reassign, reclassify & clean up in one click
Tier 3 · Automate
The full season on autopilot: track what's missing per return, and chase it without lifting a finger.
- →Everything in Organize, plus:
- →Required-document checklists per filing
- →Automated branded reminder escalation
- →Dashboard, season kanban & progress tracking
- →Client questionnaires with no-login links
One-time setup
$500 Private Instance Provisioning — we stand up your dedicated server, configure secure email routing, and import your client list. You're receiving documents the same week.
No free trial — and that's deliberate. The product proves itself when real documents flow. Capture at $99 is the low-risk way in.
The suites organize what clients upload.
Nobody handles what they email.
| Inbound email documents… | Portal suites | CPA Lightspeed |
|---|---|---|
| Captured automatically, firm-wide | Manual, per-user, or not at all | Yes — every attachment |
| Identified by form type & tax year | No — filed as "attachment" | 30+ IRS types, explainable AI |
| Matched to the right client & return | Dumped to a default folder | Identity-verified matching |
| Counted against a missing-docs checklist | No | Live per-return tracking |
| Framed as a WISP compliance control | Portal adoption is your problem | Audited vault, written control |
Keep the suite you have. Lightspeed doesn't replace Canopy, TaxDome, or Drake — it stands in front of them and catches the last mile they leave open.
Questions a careful CPA asks
Do my clients have to change anything? +
No. That is the entire point. Clients keep emailing documents exactly as they do today — to a dedicated intake address for your firm. No portals, no logins, no apps, no training calls with your 78-year-old client in February.
Where does my clients' data actually live? +
On a server dedicated to your firm — your own database, your own file store, never co-mingled with another firm's data. SSNs are stored and displayed last-4 only, credentials are encrypted, and every file operation is written to an audit log.
Does this replace my Canopy / TaxDome / Drake workflow? +
No — it feeds it. Lightspeed is the intake layer that captures, classifies, and organizes what clients email, so your existing suite works with complete, organized documents instead of whatever staff remembered to download.
Is the AI a black box? +
No. Every classification shows what it matched — the tokens found, a confidence breakdown by document type, tax year, and identity signals, plus the ownership checks it ran. If it's wrong, you reclassify in one click and the correction is logged.
Why isn't there a free trial? +
Because the product proves itself with real documents flowing during a real season — and standing up your private server is real work we do for you. Capture at $99/mo plus the $500 provisioning fee is designed to be the low-risk entry. Upgrading later is a single setting, not a migration.
Is this actually running in real firms? +
Yes — Lightspeed ran a full tax season in production for paying CPA firms, processing real client documents end to end. This is shipped software with a season of hardening behind it, not a demo.
Before next season
Your clients will keep emailing.
Make that a control, not a liability.
Private instance provisioned in days. Flat per-firm pricing from $99/mo. Zero behavior change for the people who pay you.