Encrypted email for tax preparers, on by default
Tax returns carry Social Security numbers, bank details and income records. Secria Mail stores every message in your mailbox with zero-access encryption, locked with keys made on your device, and end-to-end encryption is on by default. Use your firm’s domain on Mail Plus or Pro. Below is what IRS Publication 4557 and the FTC Safeguards Rule say about encrypting client data.
- Zero-access encryption
- Custom domain on paid plans
- Web, iPhone and Android
What the IRS and the FTC say
Do tax preparers have to encrypt email?
IRS Publication 4557 tells tax professionals to encrypt sensitive files and emails. The FTC Safeguards Rule, which covers tax preparers, calls for encryption of customer information in transit and at rest.
The IRS says to encrypt sensitive email
Publication 4557 lists this among its basic security steps: “Encrypt all sensitive files/emails, especially those with the taxpayer’s personally identifiable information, and use strong password protections.”1
Tax preparers fall under the Safeguards Rule
The same publication says: “According to the FTC Safeguards Rule, tax return preparers must create and enact security plans to protect client data.”1
The rule names encryption
The Safeguards Rule says: “Protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest.”2
Sign-in needs a second factor
Publication 4557 also lists: “Implement multi-factor authentication for anyone accessing customer information on your system.”1
The safeguards, applied to email
Four safeguards from the rule and the IRS, and where Secria fits
The Safeguards Rule covers a firm’s whole information security program. These are the parts that touch your mailbox.
| Question | What it says | With Secria Mail |
|---|---|---|
| Encryption at rest | Customer information is protected by encryption “at rest.”2 | Every message in your mailbox is stored with zero-access encryption. |
| Encryption in transit | The FTC’s guidance says: “Encrypt customer information on your system and when it’s in transit.”3 | End-to-end encryption is on by default, with ML-KEM-1024 and X25519. |
| Multi-factor authentication | Multi-factor authentication “for any individual accessing any information system.”2 | Two-factor authentication with an authenticator app or a security key. |
| Sensitive data by email | The publication’s checklist says: “If you must transmit sensitive data by email over the Internet, be sure to encrypt the data.”1 | A client can join on the free plan and get the same encryption. |
- Internal Revenue Service, Publication 4557: Safeguarding taxpayer data (Rev. 6-2024).
- Federal Trade Commission, Standards for safeguarding customer information, 16 CFR 314.4, paragraphs (c)(3) and (c)(5).
- Federal Trade Commission, FTC Safeguards Rule: What your business needs to know.
Checked October 11, 2026. This page is general information, not legal or tax advice. The IRS and FTC texts above decide what applies to your firm.
What you get with Secria
Email that protects client records by default
Your firm’s domain
Use you@yourfirm.com on Mail Plus (3 domains) or Pro (10 domains), with aliases and a catch-all address on your domain.
Sealed with your keys
Your mailbox is stored with zero-access encryption, locked with a key made from your password on your device.
End to end by default
End-to-end encryption is on by default, with ML-KEM-1024 and X25519. A client can join on the free plan and get the same encryption.
A second step at sign-in
Add two-factor authentication with an authenticator app or a security key, so a stolen password is not enough to open your mailbox.
Getting started
Move your practice’s email in three steps
Create your account
Pick Mail Plus or Pro. Save your recovery phrase when you sign up, because it is your way back in if you forget your password.
Connect your firm’s domain
Add your domain in Secria and copy the DNS records it shows you. Secria checks them for you.
Bring your archive
Import a PST file from Outlook, or MBOX and EML files, so past seasons’ client mail comes with you.
Custom domains on Mail Plus and Pro
Same encryption on every plan. Pick the one with the room you need.
Secria Pro
10 custom domains, unlimited aliases, 500 GB, and the full Secria VPN on 5 devices.
Monthly prices shown. Yearly and 2-year plans cost less per month. Compare all plans
30-day money-back on plans bought here. App Store and Google Play purchases follow their own refund rules.
Questions about encrypted email for tax preparers
Do tax preparers have to encrypt email?
IRS Publication 4557 tells tax professionals to encrypt all sensitive files and emails, especially those with a taxpayer’s personally identifiable information. The FTC Safeguards Rule requires covered firms to protect customer information by encryption in transit over external networks and at rest, or to use alternative controls approved by the firm’s Qualified Individual.
Does the FTC Safeguards Rule apply to tax preparers?
Yes. IRS Publication 4557 says that under the Safeguards Rule the definition of financial institutions includes professional tax preparers, and that tax return preparers must create and enact security plans to protect client data. The FTC’s own guidance lists tax preparation firms among the businesses the rule covers.
What does IRS Publication 4557 say about email?
It lists encrypting all sensitive files and emails among the basic security steps for tax professionals. Its checklist adds that if you must transmit sensitive data by email over the internet, you should be sure to encrypt the data. It also warns about phishing emails that pretend to come from the IRS, a tax software provider or a cloud storage provider.
Can accountants and bookkeepers use Secria too?
Yes. Any practice that handles client financial records can use Secria Mail. The encryption is the same on every plan, and custom domains come with Mail Plus and Pro.
Can I use my firm’s domain?
Yes. Secria Mail Plus connects up to 3 custom domains for $3.99 a month on monthly billing, and Secria Pro up to 10. Mail to your domain gets the same protection as any Secria address.
Is there a plan for a whole firm?
Secria Business is opening soon. Join the waitlist to hear when it does. Personal plans are available today.
Can I bring my existing mail?
Yes. Secria imports MBOX files, EML files and Outlook PST files on every plan, free included. MBOX and EML files are read and encrypted in your browser before upload.
Client records, sealed with your keys.
Your firm’s domain on Mail Plus or Pro.