Security
How we protect your data
Rival Practice helps your firm get found, answer every call, and follow up with every lead. Here is exactly what we hold, what we don't, and how we keep it safe - in plain language, with no claim we can't back up.
What we hold, and what we don't
We hold your marketing data - never your clients' records
What we hold
A firm's marketing and growth data - the information you enter and the leads you earn:
- Your own contacts - names, emails, phone numbers and the notes you enter
- Your campaigns and website enquiries
- AI receptionist call summaries
What we don't
By design, the most sensitive data never enters the system:
- No clients' tax returns, financial records or ID documents
- No logins for your firm's own clients - they never sign in
- No card numbers - payments are handled by Stripe; we never see or store them
Call transcripts are deleted automatically after 90 days.
How we keep it safe
The controls behind your workspace
Kept separate for every firm
Each firm's data lives in its own isolated space - Authority firms get their own dedicated database - and a sign-in only ever reaches its own firm.
Encrypted
Every connection uses HTTPS (HSTS enforced), and data is encrypted at rest. Credentials you connect from other software are encrypted with a separate key for each firm.
Sign-in and access
- One-time sign-in links and codes that expire
- Two-step sign-in with an authenticator app for every user - owners can require it for the whole team
- Rival staff must use two-step sign-in
- Owner, Admin and Staff roles
- Every action Rival staff take in a firm's account is logged
Backups and recovery
Nightly backups plus point-in-time recovery, with a second copy in a separate, locked account kept for over 30 days. We test restores.
Email done right
Authenticated sending (SPF, DKIM and DMARC), and every unsubscribe is honored.
Watching and responding
Automatic monitoring and alerts on failures and errors. If we ever find a security incident affecting your data, we will tell you promptly - what happened, what it means for you, and what to do - as the law requires.
Our security program
We are formalizing our Written Information Security Plan to the FTC Safeguards Rule and IRS Publication 4557 - the same standards tax professionals follow - and will share a summary with clients on request.
Questions?
We're happy to walk your team or your IT reviewer through any of this.
support@rivalpractice.com