For tax preparers, CPAs & bookkeepers

Tax-prep PDF tools built for IRS Pub 4557.

Client data stays on your machine. Where the IRS expects it to be.

A document sealed inside a Faraday cage. Your files stay fully private, on your device. A document sealed inside a Faraday cage. Your files stay fully private, on your device.

The two rules behind every preparer audit.

The IRS and the FTC both require a written, current, vendor-aware security plan.

IRS Publication 4557 & FTC Safeguards Rule (16 CFR Part 314)

A tax preparer must develop, implement, and maintain a Written Information Security Program (WISP) that includes administrative, technical, and physical safeguards appropriate to the size and complexity of the firm and the sensitivity of the information.

The post-2023 FTC Safeguards Rule strengthened the WISP requirement, mandating a named Qualified Individual, encryption at rest and in transit, and an inventory of all data flows including third-party vendors. Cloud-uploading PDFs of client returns expands that inventory: every vendor you add is one more entry to document, audit, and notify around.

The penalty stack on a single leaked return.

IRS preparer penalties

Disclosure or use of taxpayer info without consent triggers IRC §6713 (civil) and §7216 (criminal). Up to $1,000 per occurrence or one year imprisonment.

FTC fines

Post-2023 Safeguards Rule strengthening expanded enforcement. Violations can compound: civil penalties plus mandatory third-party assessments for years afterward.

State CPA board sanctions

State boards of accountancy issue independent sanctions including license suspension. Many states require breach reporting separate from IRS.

Built for tax season.

PII / SSN / EIN redaction

One click loads the Tax documents profile. It flags SSNs, ITINs, EINs, bank account and routing numbers, plus client names and addresses, so a W-2, 1099 or return is sanitized before a partner firm or seasonal staffer ever sees it. Pattern-aware detection does the first pass. You review every page before you share.

Bank statement parser exploring

PDF to Excel for Chase, BofA, Wells, Stripe receipts and the major card processors. All parsing on-device.

Metadata scrub

Redaction rebuilds the PDF from scratch, removing embedded "Last saved by" stamps from prior preparer software, hidden author names, and Adobe revision history.

No upload = simpler WISP

Your data-flow inventory doesn't grow when you process PDFs locally. One fewer vendor row, one fewer breach vector, one fewer audit finding.

Drop-in for your WISP.

A pre-written one-page statement you can paste into your firm's existing Written Information Security Program.

The FTC Safeguards Rule and IRS Pub 4557 both want to see, in writing, exactly how each vendor in your stack handles client data. KeptPDF's entry is short: "KeptPDF processes PDFs entirely within the preparer's browser. No PII or client return data is transmitted to or stored on KeptPDF's servers. Because client data never leaves the preparer's device, KeptPDF functions as local software rather than a data-handling service provider. The firm should confirm with its advisors whether a separate data-processing or service-provider agreement is warranted."

You can paste the statement above directly into your WISP at renewal. It documents our architecture and lists the JavaScript libraries we load.

Pricing for accountants.

Pro

$29/month

For a solo preparer: $290/yr saves 2 months

  • SSN & PII redaction with SHA-256 audit cert
  • Clean output, no KeptPDF watermark
  • Saved redact lists: always-redact client SSNs & tax IDs, never-flag your usual false positives
  • Metadata scrub + batch processing
  • Unlimited bulk redaction across client files
  • Larger files (practical limit ~500 MB)
  • Priority email support
Get Pro
Founding offer

Lock $99 per seat for life

The Practice rate goes up as the suite grows. Founding firms never pay more than today's price, for as long as you stay. For the first 25 practices.

See the founding offer

Prefer to try first? Start free, no card required.

See what does, and doesn't, leave your browser.

Verify it yourself