Medlin Software

Computer and Data Security

The IRS has been reminding tax professionals of the requirement to secure data (which actually began in 2023). The requirement applies only to those subject to the FTC Safeguards rule. For Medlin Software customers, that means tax professionals or accountants — such as tax preparers who also handle payroll or accounting, and CPAs and EAs. This rule does not apply to those managing just their own data, such as preparing your own payroll and/or accounting.

What we describe here is EXACTLY what we do to secure our own computers, and it is not a bad idea for anyone who has apps and data on their computer they do not want others to access.

REMEMBER, with Medlin Software you are using an offline app with data stored offline. That means you control the app and the data, because both live on your device! This is a critical reason Medlin Software does not need to build in its own MFA process.

There are three methods of authentication recognized by the FTC. The FTC says 2 of the 3 are required for their MFA rule. We say all 3 should be met.

1. Knowledge — set a BIOS-level password/PIN for your device
   • This has to be entered every time your computer powers on or returns from hibernation.
   • This level of protection is ideal, as it prevents "brute force" attacks.
   • Make sure your computer cannot go into "sleep" mode, since waking from sleep does not require the BIOS password/PIN.
   • If practical, use the Windows feature that connects your phone to your computer, so your computer hibernates if you walk away with your phone.
2. Possession — device control
   • The Medlin app and the data you manage with it are offline, meaning they reside on your device.
   • You control access to your device, so you meet #2 by keeping control of your device.
   • No one else possessing your device means no one else can access the data.
3. Inherence — set Windows "Hello" to use facial recognition, with a password/PIN as a backup
   • Do not use the same password/PIN you set up for power-on and return from hibernation.

Notes

• Use BitLocker to encrypt your hard drive
  • Encrypted data is part of the Safeguards rules too.
  • Encrypting your drive is critical if your computer "disappears" — as long as you use power-off and hibernate only (NOT sleep mode).
• Our online backup storage is encrypted
  • Your backup is encrypted on your computer before it is sent. We store only the encrypted data.
  • We do not open or read the contents of your backups.
  • This supports common sense and the FTC Safeguards rules.
• Keep your own backups
  • Local and online, using whatever methods you prefer. No single copy of anything is a backup plan.

Coming Soon: the "Anywhere" Add-On

We are building an optional add-on, tentatively called "Anywhere," that will let you store your data file in the cloud so you can move it between your own devices. It is not available yet. This is a separate add-on and is not part of our current programs.

It works differently from our current online backup storage, so it is worth understanding the difference before it arrives.

• You choose a passphrase. Your data is encrypted on your computer with that passphrase before it is sent. We never receive it.
• We cannot see, reset, or clear your passphrase. There is no back door and no recovery code. We are not being coy about this — we designed it so that we cannot do it.
• If you lose your passphrase, the data is gone. Not "call support and we will sort it out" gone. Actually gone. Write it down and keep it somewhere safe.
• You can change your passphrase from inside the software, using your current one.
• The app stays offline. Your payroll still runs on your computer. Only the stored copy of your data file lives in the cloud, and it lives there as encrypted data we cannot read.

For anyone under the FTC Safeguards rule, this design is the point: data at rest in the cloud is encrypted, and the only party holding the key is you.

Questions? Email questions@medlin.com.

Support home  ·  Support Policy  ·  Privacy Policy