Vendor review packet
Last updated: November 1, 2026
This page is not legal advice. You decide whether we meet your standards.
UNTAP LLC provides Sidesheet, which reads the business tax returns a firm uploads (Forms 1120, 1120-S and 1065, with K-1s) and builds financials from them. This page collects what a firm needs to review us as a service provider, so you can file it with your written information security program (WISP). The binding promises are in our Terms of Service and our Data Processing Addendum (DPA), which forms part of the Terms and applies to every customer automatically. A countersigned copy of the DPA is available on request to legal@sidesheet.co.
What the FTC Safeguards Rule asks of you
Tax preparers and CPA firms can be "financial institutions" under the FTC Safeguards Rule (16 CFR Part 314). Section 314.4(f) requires you to:
"(f) Oversee service providers, by: (1) Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue; (2) Requiring your service providers by contract to implement and maintain such safeguards; and (3) Periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards."
The next three sections follow those three steps: our safeguards for (f)(1), our contract for (f)(2), and how you can assess us over time for (f)(3).
Our safeguards
Where your data is. We process and store Customer Data only in the United States (Terms §4.1).
Hosting and file storage: Google Cloud, us-central1 (Iowa). AI: Google's US multi-region. Database
and sign-in: Supabase, us-west-2 (Oregon). Details: Security,
"Where your data is".
Encryption. TLS 1.2 or higher in transit. AES-256 at rest for the database, stored files and backups. Stored files are encrypted with a key we manage in Google Cloud Key Management Service, rotated at least yearly. Download links are signed and expire after 5 minutes.
Separation between customers. The database enforces each firm's separation with row-level security, so a bug in application code cannot show one firm another firm's files. Automated tests check this on every change.
Staff access. Our staff do not access Customer Data except in the four cases of Terms §4.2:
- when you ask us in writing for help with a specific issue, for the period you state;
- when the service detects a likely error in reading an upload, or you report one: only that upload and its results, only as needed to investigate and fix the error;
- as needed to investigate a security incident or keep the service running; or
- as required by law.
Reads and writes of stored files are logged automatically and the logs are kept for 1 year. Logs never contain values from your returns. Every person with access to Customer Data is bound by a written confidentiality obligation (DPA §2.3).
Sign-in. Multi-factor authentication is required for every user by default, with an authenticator-app code at every sign-in, enforced by the database. A firm admin can make it optional for the firm (Terms §3.5). Sessions end after 14 days without activity and after 30 days at most. A lost authenticator is never reset by email alone.
Changes to the service. Only code merged to our main branch that passes automated checks can reach production.
AI. Models read the pages of your returns through Google Cloud Vertex AI, in the United States. Neither we nor Google train models on your data (Terms §2.3). Details: How we read returns.
Our contract
The Terms and the DPA are the contract. You accept them when you create your account; there is nothing extra to sign.
| Commitment | Where |
|---|---|
| We implement and maintain safeguards for customer information, as the Safeguards Rule defines it | DPA §10, §4 and Annex 1 |
| Safeguards, encryption in transit and at rest, United States only | Terms §4.1 |
| Staff access only in four cases; access to stored files logged | Terms §4.2 |
| Notice within 48 hours of confirming an incident that resulted in unauthorized access to or disclosure of your Customer Data | Terms §4.4; DPA §5 |
| No training of AI models on your data | Terms §2.3 |
| No sale, sharing or combining of your data | Terms §2.5 |
| Retention, return and deletion | Terms §5; DPA §8 |
| Subprocessors bound by written terms; 30 days' notice before a change | Terms §8; DPA §3 |
| Confidentiality | Terms §9 |
| Service provider under the CCPA and similar state laws | DPA §9 |
Assessing us over time
- Questionnaires. Email security@sidesheet.co. We answer reasonable security and vendor-review questionnaires in writing up to once every 12 months, and again after an incident (DPA §7.1).
- Subprocessor changes. We email your admins at least 30 days before we add or replace a subprocessor, and update Subprocessors (Terms §8.2).
- Incidents. We tell you within 48 hours of confirming an incident that resulted in unauthorized access to or disclosure of your Customer Data (Terms §4.4).
- Changes to our terms. We give at least 30 days' notice of a material change to the Terms or the DPA (Terms §13; DPA §11.4). Each legal page shows the date it was last updated.
Retention and deletion
- We delete each uploaded file automatically 7 years after upload (Terms §5.1).
- When you remove a return, we delete its file and the values read from it (Terms §5.1).
- To have us delete all of your firm's Customer Data, email privacy@sidesheet.co. We delete it from production systems within 30 days, and backups containing it expire within a further 30 days. On request we confirm deletion in writing (Terms §5.2).
- We keep Customer Data longer only where the law or valid legal process requires it (Terms §5.3).
Other retention periods are on Security, "Retention and deletion".
For your WISP vendor inventory
| Field | Entry |
|---|---|
| Vendor | UNTAP LLC (Sidesheet), 1335 Candlewood Dr. NE, Keizer, OR 97303, United States |
| Service | Reads uploaded business tax returns and builds financials for valuation work |
| Customer information received | Uploaded business returns (1120, 1120-S, 1065) and K-1s, which may include owners' names, addresses and Social Security numbers; the financials built from them; your users' names and email addresses |
| Location | United States only |
| Contract | Terms of Service and Data Processing Addendum, effective October 31, 2026 |
| Incident notice | Within 48 hours of confirming an incident (Terms §4.4) |
| Contact | security@sidesheet.co |
Subprocessors
The full list, with what each one receives and where, is at Subprocessors.
| Subprocessor | What it does for us | Receives return content through the service? |
|---|---|---|
| Google LLC (Google Cloud) | Hosting, file storage, AI reading (Vertex AI), job queue | Yes |
| Supabase, Inc. (on Amazon Web Services) | Database and sign-in | Yes |
| Google LLC (Google Workspace) | Our email, including support | No (only if you email it to us) |
| Twilio Inc. (SendGrid) | Account emails | No |
| Stripe, Inc. | Payments | No |
Related guidance
The IRS publishes security guidance for tax professionals, including on overseeing service providers. If your firm prepared a return you upload, federal law (26 U.S.C. §7216) may require your client's written consent first (Terms §3.2).
Questions
Security: security@sidesheet.co · Privacy: privacy@sidesheet.co · UNTAP LLC, 1335 Candlewood Dr. NE, Keizer, OR 97303, United States