The WISP you don't have
Every PTIN holder is required to maintain a written information security plan. Most offices have a template downloaded once and never revisited — which is not a plan, and does not survive a review.
For tax preparers & PTIN holders
Your WISP, written.
Your client, verified.
Verafile is the compliance and identity layer for tax offices. Generate an IRS-aligned written information security plan, verify every taxpayer with document and biometric checks, and keep the audit trail that proves you did.
- Pub. 4557
- WISP aligned
- 3 checks
- Doc · liveness · match
- No app
- Browser capture
- Immutable
- Audit log
The exposure
Three gaps sit between your office and a bad season.
The client you've never met
Remote intake means a stolen ID photo and a borrowed phone number are often enough to file under someone else's name. Your PTIN is on that return.
The documents everywhere
Sensitive taxpayer data sitting in SMS, personal email, and desktop folders is the single most common finding after a preparer breach.
How it works
Four steps, run once per client.
Step 01
Stand up your WISP
Answer a guided intake about your office, staff, software, and data flows. Verafile generates a written information security plan aligned to IRS Pub. 4557 and the FTC Safeguards Rule — with your named security lead, risk assessment, and incident response plan filled in.
Step 02
Verify the client, not the paperwork
Send a secure link. The taxpayer captures a government ID and a live selfie. Liveness detection and face match confirm the person in front of the camera is the person on the document — before any 8879 gets signed.
Step 03
Collect documents in the vault
W-2s, 1099s, IDs, and consents land in an encrypted client vault instead of a text thread or personal inbox. Access is role-scoped to the preparers who need it.
Step 04
Keep the evidence
Every verification, document access, and plan revision is written to an immutable audit log you can hand to the IRS, a carrier, or your E&O insurer.
Verification record
VERIFIED- PASS
Document authenticity
Security features + MRZ checksum
- PASS
Liveness
Passive challenge, single capture
- 0.94
Face match
Selfie vs. document portrait
- LOW
Device / IP risk
No emulator, no known proxy
- MATCH
Prior-year identity
Returning client fingerprint
Illustrative record. Signals shown reflect the system as designed.
WISP
A living plan, not a downloaded template.
Verafile builds your written information security plan from how your office actually operates, then keeps it current as staff, software, and data flows change. Every revision is versioned and dated so you can show what your safeguards were on any given day.
- Named security lead and staff responsibilities
- Risk assessment across intake, storage, and transmission
- Access controls, MFA policy, and device standards
- Vendor and software inventory
- Incident response and breach notification steps
- Annual review reminders with versioned history
Pricing
Priced per office, per season.
Solo
$49/mo
One PTIN holder. WISP generation, unlimited plan revisions, and 50 client verifications per season.
Talk to usMost offices
Office
$149/mo
Up to 10 preparers, role-scoped document vault, staff acknowledgements, and 500 verifications per season.
Talk to usMulti-site
Custom
Franchise and multi-location groups. SSO, centralized policy, per-location audit reporting, and volume verification.
Talk to usPricing reflects planned launch packaging and may change before general availability.
FAQ
Questions preparers ask.
Is a WISP actually required for my office?+
Yes. The FTC Safeguards Rule and IRS Pub. 4557 require every paid preparer — including solo PTIN holders — to maintain a written information security plan. It is also attested to at PTIN renewal.
What does biometric verification actually check?+
Three things: that the ID document is authentic, that the person on camera is physically present (liveness), and that their face matches the document portrait. All three run before the return is signed.
Do my clients need to download an app?+
No. Verification runs in the phone browser from a secure link you send by text or email.
What happens to the biometric data?+
Face templates are used for the match and are not sold, shared, or used to train models. Retention is configurable per office, and every access is logged.
How is this different from VeraVault?+
Verafile protects the preparer's office and taxpayer relationship. VeraVault is our patent-pending issuance-time identity layer for card issuers and program managers.
Talk to us
Get your WISP in place before the next filing season.
Tell us about your office and we'll walk you through the plan and the verification flow. Every request reaches us directly — no phone tree, no chatbot.
VeraVault for card issuers