For most businesses, a CRM is a sales and service tool. For a tax practice, it’s also a data security and compliance system. Every record in a tax firm’s CRM can contain Social Security numbers, income details, bank information and family data, exactly the information criminals target for identity theft and fraudulent refunds.
This guide looks at “CRM tax” from that angle: how tax practices should use a CRM for intake, communication and workflow while meeting their obligations to protect taxpayer data and to use it only in permitted ways. If you’re looking for a comparison of software vendors, see our tax CRM buyer’s guide.
*This article is general information, not legal advice. Consult a qualified professional about your firm’s specific obligations.*
Why CRM Is Different in a Tax Practice
A tax firm’s CRM holds three kinds of information:
- Relationship data: names, contact details, communication history and service preferences
- Engagement data: which returns and services you provide, deadlines, status and fees
- Tax return information: income, deductions, identification numbers and documents
The third category is what makes tax CRM special. In the United States, it’s subject to specific rules on safeguarding and use, and mistakes can carry serious professional, financial and reputational consequences.
The Rules Every Tax Firm’s CRM Must Support
Safeguarding taxpayer data
The IRS has long reminded preparers that they are responsible for protecting client data. IRS Publication 4557, Safeguarding Taxpayer Data, sets out security expectations for tax professionals, and Publication 5708 provides a template to help small practices create a written information security plan.
The FTC Safeguards Rule
Tax preparers are generally treated as financial institutions under the Gramm-Leach-Bliley Act and must comply with the FTC Safeguards Rule. That includes maintaining a written information security program, appointing a qualified individual to oversee it, conducting risk assessments, encrypting customer information, using multi-factor authentication, and overseeing service providers. Amendments that took effect in 2024 also require notifying the FTC of certain security events affecting 500 or more consumers.
Your CRM vendor is one of those service providers. Its security, and how you configure it, is part of your compliance.
Section 7216 and use of tax return information
Internal Revenue Code Section 7216 and its regulations restrict how preparers use and disclose tax return information. In general, using that information for purposes other than preparing the return, for example certain marketing of non-tax products or sharing it with third parties, requires the taxpayer’s written consent in a specific form, subject to defined exceptions.
For CRM, this matters whenever you:
- Build marketing segments from tax data (for example, clients with high income or rental properties)
- Send campaigns promoting non-tax services such as insurance or investments
- Share CRM data with partners, referral networks or affiliated businesses
- Use third-party tools that process tax return information
Track consent in the CRM with dates, scope and the signed form, and design segments so they respect consent status.
E-file and identity requirements
Firms participating in IRS e-file must follow security and identity requirements. Your CRM workflow should support identity verification at intake and secure handling of authorisation forms.
Building a Secure CRM Intake Process
A strong intake process protects the firm from the first interaction.
- Collect data through the secure portal, not email. Send a portal invitation as the first step and discourage clients from emailing documents.
- Verify identity. For new clients, verify identity before accepting documents or discussing tax matters, especially for remote clients.
- Send the engagement letter for e-signature. Define services, responsibilities and fees.
- Collect required consents. Include any Section 7216 consents you need, separately and clearly.
- Record authorisations. Track forms such as power of attorney or tax information authorisation with expiry dates.
- Only collect what you need. Minimising data reduces risk.
Security Settings to Configure in Your CRM
| Setting | Why it matters |
|---|---|
| Multi-factor authentication for all users | Blocks most credential-based account takeovers |
| Role-based permissions | Staff only see the clients and data they need |
| Client portal MFA | Protects clients’ access to their own documents |
| Audit logs | Shows who accessed or changed records and when |
| Session timeouts | Reduces risk on shared or unattended devices |
| Data retention rules | Removes data you no longer need to keep |
| Secure integrations | Limits which apps can access CRM data |
| Encrypted storage and transfer | Protects data at rest and in transit |
Ask vendors for current security documentation, such as SOC 2 reports, encryption standards and breach notification procedures.
CRM Workflows for Tax Resolution Firms
Tax resolution practices, which help clients with IRS debts, audits, liens and levies, rely heavily on CRM because cases can last months or years. A typical workflow includes:
- Lead intake and qualification. Capture the issue, amount owed and urgency.
- Authorisation. Obtain power of attorney or tax information authorisation so the firm can act or access records.
- Investigation. Pull transcripts, identify unfiled returns and calculate liabilities.
- Compliance. Prepare and file any missing returns.
- Resolution. Pursue options such as installment agreements, offers in compromise, penalty abatement or currently-not-collectible status.
- Monitoring. Track compliance with the agreement and upcoming deadlines.
Specialist platforms such as IRS Logics and Canopy include resolution features. General tax CRMs can work if you build clear pipelines, document templates and deadline tracking.
Marketing Responsibly From a Tax CRM
A CRM makes it easy to communicate with clients year-round, which is good for retention and advisory growth. Keep it compliant and respectful:
- Separate relationship marketing from tax-data marketing. A newsletter about deadlines based only on contact details is very different from a campaign targeted using income data.
- Honour consent and preferences. Record opt-ins and opt-outs for email and SMS.
- Be cautious with SMS. Text marketing requires appropriate consent under the Telephone Consumer Protection Act.
- Watch for phishing lookalikes. Educate clients that you’ll never ask for sensitive information by email or text and that documents go through the portal.
Annual CRM Compliance Checklist for Tax Firms
- Review and update your written information security plan
- Confirm MFA is enforced for every staff and client account
- Remove access for former staff and contractors
- Review user permissions and audit logs
- Check Section 7216 consents and marketing segments
- Review data retention and delete records you no longer need
- Confirm vendor security documentation is current
- Test backup and recovery
- Train staff on phishing, social engineering and secure client communication
Common CRM Security Mistakes in Tax Practices
Even firms with good software make avoidable mistakes. Watch for these:
- Shared logins. Every staff member needs a unique account so access can be audited and removed.
- Exporting client lists to spreadsheets. Exports often end up on laptops, email or USB drives where they’re poorly protected. Limit export permissions.
- Over-permissioned seasonal staff. Temporary preparers should only see the clients assigned to them, and their access should end when the season does.
- Unvetted integrations. Connecting marketing or AI tools to your CRM can expose tax data to new vendors. Review what data each integration can read.
- Mixing personal and business devices without controls. Require device security standards for anyone accessing the CRM remotely.
- Weak client verification on the phone. Fraudsters may impersonate clients to change bank details or obtain copies of returns. Use verification steps recorded in the CRM.
Questions to Ask Your CRM Vendor About Tax Data
- Where is client data stored, and is it encrypted at rest and in transit?
- Do you provide a current independent security report, such as SOC 2?
- Can we enforce MFA for both staff and clients?
- How granular are user permissions?
- What audit logging is available, and how long are logs retained?
- How will you notify us of a security incident, and how quickly?
- Can we export and delete our data if we leave?
The answers should feed directly into your written information security plan.
Frequently Asked Questions
What does “CRM tax” mean?
It usually refers to CRM software used by tax practices, or to the tax-specific considerations of running a CRM in a tax firm, such as data security and consent rules.
Do tax preparers need a written security plan?
Under the FTC Safeguards Rule, tax preparers are generally required to maintain a written information security program. IRS Publication 5708 provides a template for small practices.
Can I use client tax data for marketing?
Using tax return information for purposes beyond return preparation is restricted under Section 7216 and generally requires specific written consent, subject to exceptions. Get professional advice before building marketing campaigns on tax data.
Is it safe to email tax documents?
Standard email isn’t a secure way to send sensitive tax documents. Use an encrypted client portal instead.
Which CRM is best for tax resolution?
Firms often use specialist tools such as IRS Logics, or practice management platforms like Canopy with resolution features. See our tax CRM guide for comparisons.
Final Thoughts
In a tax practice, the CRM is where client relationships and regulatory responsibilities meet. Choose software with strong security, configure it carefully, track consents rigorously and train your team. Done well, a CRM lets you deliver a faster, friendlier client experience while protecting the data your clients trust you with.
Related reading: what is a CRM database and CRM data cleaning services.