Who Owns Your Tax Firm’s Data? A Data Ownership Guide

You own your tax firm’s data. Your cloud host or IT provider holds it. Those are two different things, and the gap is where firms get stuck. To keep ownership real, confirm three things before you sign: your data-export rights are in writing, the contract is one you can leave, and you run on an environment your firm controls.

Key takeaways

• Owning your data and being able to retrieve it are not the same thing. The contract decides the second.
• The friction shows up at exit: long release timelines, format limits, and fees to hand back files that were always yours.
• Data ownership is seven specific rights, not one slogan. A data bill of rights is below.
• Three protections keep ownership real: written export rights, a contract you can leave, and an environment you control.
• Get the exit terms, export format, and any release fee in writing before you sign.

Every tax firm runs on data it cannot afford to lose. Client returns, source documents, QuickBooks company files, the working papers behind every engagement. Most of that now lives in the cloud, or on systems a managed IT provider runs for you. That is usually a good trade. Private cloud hosting and professional IT management beat a server in a closet on speed, safety, and compliance. But both raise a question most firms never ask until the worst possible moment: if you decide to leave, how fast and how cleanly do you get your data and your access back?

The answer is rarely “instantly,” and for a growing number of firms it has become “not for months.” That is worth slowing down for, because the data is yours, and the friction of getting it back is a choice your vendor made. This guide covers the whole picture: what ownership means, why it is suddenly a topic, the clauses and rights that protect you, how to switch without losing anything, and the questions to ask before you sign. None of it is legal advice. Use it to know what to confirm, and run anything you are unsure about past your own counsel.

What does it actually mean to own your firm’s data?

Owning your data means the files are legally yours and you can move them, in a usable format, without permission. Holding it means a vendor stores it or controls access for you. Every cloud host and IT provider does that. “You own your data” is the floor, not the answer. The contract decides what you can act on.

The distinction matters because the two rarely come up at the same time. When you sign, the conversation is about onboarding: how fast can we get you running. When you leave, the conversation is about offboarding, and that is where the terms you skimmed on day one decide what happens. A platform can affirm that you own your data in its marketing and still take months to release it, charge to export it, or hand it back in a format that is painful to use. None of that contradicts “you own your data.” It just makes ownership hard to act on.

So treat “you own your data” as a starting point. The follow-up question is always the same: then what exactly happens when we ask for it back? For a tax firm the stakes are specific. Your data is tied to filing deadlines, retention rules, and client trust. A delay that would annoy another business can put your season at risk.

Allows me access to both our QuickBooks files and Tax software from where ever I am working.

Eric L., Owner, Focus Capital Advisors, G2 (Apr 2025)

Why is data ownership suddenly a big topic in accounting?

Because the people firm owners listen to have made it one, and because lock-in has gotten harder to ignore. As the industry consolidates, platforms assembled by acquisition are measured on retention, and retention is often just switching cost with a nicer name. The voices firms trust keep saying it: own your stack, do not rent it.

Jason Staats, one of the most followed voices in the profession, has spent years telling firm owners to own their stack instead of renting it: keep your data portable, avoid getting boxed into one platform, and treat tech independence as a business asset. He is not alone. Blake Oliver and David Leary track on The Accounting Podcast which vendors are quietly shifting data responsibility onto firms and which platforms are tightening their grip. David Leary, a former Intuit insider, has long pointed out how platform strategy decisions ripple down to your firm’s toolset and your exit options. Randy Johnston of K2 Enterprises connects the same dots to compliance and vendor due diligence.

The through-line is the same: the firm that controls its own data and tools has the upper hand, and the firm that does not is at the mercy of a roadmap it did not write. That message has landed because the industry has consolidated. Platforms assembled by acquisition are measured on retention, and a months-long wait to retrieve your own data has started to read as standard practice. That is the signal the market has drifted, not that your expectations are unreasonable.

Staats puts the gap between owning your data and getting it back in plain terms:

There are still a lot of tools in our industry, even SaaS tools that don’t have an API or won’t give you access to your own data. People feel this pain most when they switch systems and they realize all of that data in the old system isn’t going to come over.

Jason Staats, CPA, founder of Realize, Karbon Magazine

How do firms get locked in without realizing it?

Lock-in is rarely a single clause. It is an accumulation of small dependencies that each look reasonable alone: the hosting, then export tooling only that vendor sells, then bundled add-ons like security, consulting, or an AI assistant. By the time you want to leave, unwinding it means untangling four or five things at once, not one.

A few patterns signal a contract built to make leaving hard. None is disqualifying on its own, but together they describe a platform that competes on switching cost rather than service.

• The contract affirms ownership but says nothing specific about export format or timeline.
• The term is annual or multi-year and auto-renewing, with a narrow cancellation window.
• Tools you rely on are bundled on a long-term contract in a way that makes them hard to drop one at a time.
• There is a fee to export or release your data, or per-hour charges to support your offboarding.
• A managed IT provider is the sole holder of your admin credentials and Microsoft 365 tenant, with no transition-assistance clause.
• The vendor’s answers to exit questions are verbal reassurances rather than contract language.

The friction that results has become common enough to feel normal. Firms report being told their data release will take weeks or months after they give notice, sometimes across multiple filing periods. The files were always the firm’s. The delay is the platform’s.

Does bundling AI with your host lock your firm in?

It can, when the AI tool ships only as part of the hosting plan. If you keep the assistant only by keeping the platform, your AI decision and your hosting decision become one. The protection is to host on an environment you control, run the tools you choose, and stay on terms you can leave.

The accounting market already shows the pattern. Rightworks introduced its Spark assistant in 2023 and markets it as an accounting-native AI built on leading third-party language models, with accounting-specific prompts and workflows layered on top. By 2026 Spark is embedded inside the Rightworks platform and accepts document uploads. Two things matter for a buyer: the assistant is positioned as a drafting aid rather than a final answer, and it ships bundled with cloud hosting rather than as a standalone product. If the AI only exists inside the hosting, then dropping the hosting means dropping the AI, and that is the switching cost doing its job.

None of this makes a bundled assistant bad software. It makes the packaging a retention tool. The way to keep your options open is to separate the two decisions: pick hosting on its own merits, and keep your AI tools portable. Your firm can choose which AI tools to adopt and govern, and leading general-purpose assistants are available to any firm with a browser and a clear data-handling policy. You should not have to give up your hosting to switch which one you use.

Which contract clauses decide whether you keep control?

Five clauses decide whether your data stays portable, and they apply to a cloud host or local IT provider alike: data ownership, export format, release timeline, exit or release fees, and contract term. Find each one. If a clause is missing, that absence is the answer, because the vendor’s reading fills the gap when you leave.

1. Data ownership. The contract should state plainly that your firm owns its data, not just that the vendor stores it. Most vendors affirm this. The catch is that ownership alone does not guarantee retrieval. The next four clauses are what make ownership real.
2. Export format. Native QuickBooks company files, standard document formats, and an organized file structure are usable. A massive undifferentiated dump, a proprietary format, or read-only access is not. “We will export your data” without a format named can mean almost anything.
3. Release timeline. How many business days from your request to your data in hand? This is the clause that has quietly gotten worse across the industry. A clear number on paper is your protection. No number means the timeline is whatever the vendor decides when the day comes.
4. Exit or release fees. Is there any charge to export, release, or transfer your data when you leave? There should not be. The files are yours. A fee to hand back your own data is a toll on the exit.
5. Contract term and renewal. Month-to-month or annual? Auto-renewing? What is the notice window to cancel without penalty? Annual terms with automatic renewal are where firms get trapped for an extra year because they missed a notice date.

Treat verbal reassurance as a prompt to ask for the same thing in writing. If a salesperson tells you leaving is easy, that is the moment to ask for it in the document.

What about a local IT provider?

A managed IT provider holds more than your data. It holds the access that controls your data: the administrator credentials to your network, your Microsoft 365 tenant, your domain and DNS, your backups, and the documentation of how everything is set up. So add two clauses to the five above: credential and tenant ownership, and a written transition-assistance clause.

Credential and tenant ownership. Who holds the administrator credentials, your firm or the managed IT provider? Your firm should own or co-hold them. If the provider is the sole administrator and the relationship ends, you are asking the company you just fired to hand you the keys, and the contract decides how that goes.

Transition-assistance clause. This obligates the provider to support a clean handover when you leave: exporting data, transferring credentials and the Microsoft 365 tenant, and providing the documentation a new provider needs to take over. Without it, “we own the data” can still mean weeks of stalled access while your new provider rebuilds from scratch.

Local IT contracts also skew longer and pricier than cloud hosting, often multiple years with automatic renewal. Read the cancellation window, the early-termination fee, and any per-hour offboarding charges before you sign. With an IT provider the data is usually fine. The real risk is being locked out of the systems that reach it, so make the access transfer a named deliverable, not an afterthought.

What are the seven rights in a tax firm’s data bill of rights?

Data ownership is seven specific rights, not one slogan: to own your data, export it, get a usable format and a clear timeline, leave without a fee, exit the contract, and control your environment. A provider that clears all seven respects your ownership. Any “no” is a precise thing to ask for in writing.

Use this two ways: to vet a host before you sign, and to audit the one you already use. Both take about ten minutes.

1. The right to own your data. Your contract states plainly that your firm owns its data, not that the provider stores or licenses it back to you. For managed IT, ownership extends to the keys: credentials, tenant, and domain. Red flag: ownership is implied but never stated.
2. The right to export your data. You can retrieve all of it, on request, without a sales conversation. Red flag: export is “handled case by case” or requires escalation every time.
3. The right to a usable format. Native company files, standard document formats, tax software data files, and an organized structure. Red flag: a proprietary format, read-only access, or an undifferentiated dump.
4. The right to a clear timeline. Release within a defined number of business days, in writing. Red flag: no timeline, or a window measured in weeks or months.
5. The right to leave without a toll. No fee to export, release, or transfer your data. Red flag: any export, release, or “data handling” fee tied to offboarding.
6. The right to a contract you can leave. A term you can exit on a reasonable schedule. Month-to-month is cleanest. Red flag: auto-renewing annual terms with a narrow cancellation window.
7. The right to an environment you control. A dedicated private server, not a shared platform where access depends on the vendor’s queue, plus credentials your firm holds or co-holds. Red flag: a shared, catalog-based platform that limits the tools you run.

A confident provider says yes to all seven without flinching. A provider that competes on switching costs starts hedging around rights two through five. Keep your own copy of your data and backups regardless of how good your provider is.

I particularly value the secure nature of Verito, which gives me peace of mind knowing that I do not have to worry about security, and it ensures my data is regularly backed up.

David C., Owner, David Cleaver-Bartholomew, EA, G2 (Oct 2025)

How do you switch hosts or IT providers without losing your data?

Switching cleanly comes down to sequence and timing, not technology. Read your contract’s exit terms first, request your export in writing with a deadline, set up the new provider before you cancel the old one, verify every file landed before cutover, and do it in the off-season. Most risk is poor sequencing and an unpinned release timeline.

The single most common surprise is how long the current vendor takes to release your data after notice. Waits of weeks are normal, and waits of months have become common enough that firms now plan around them. Start the project in the off-season, late spring through fall for most tax firms, with a runway longer than the worst release timeline you can imagine. A clean sequence looks like this.

1. Set up the new host first. Get your applications installed and your environment configured before you touch the old contract.
2. Request your data export in writing, with a deadline. Reference the contract’s release terms and keep the paper trail. A written request with a date is harder to slow-walk than a phone call.
3. Inventory what has to move. QuickBooks company files, tax software data files and prior-year returns, source documents, working papers, email and document archives, custom configurations. Leaving an IT provider? Add admin credentials, the Microsoft 365 tenant, domain and DNS, and network documentation.
4. Transfer and rebuild on the new platform. Move the data, reinstall and license the applications, recreate user accounts and permissions. Match the inventory item by item.
5. Verify everything before cutover. Open real client files. Check that prior-year returns load and company files balance. Verify against your list, not your memory.
6. Cut over, then cancel. Move your team, confirm a normal working day, and only then cancel the old contract per its notice terms. Keep your exported data and backups in your own possession regardless.

The order is the protection. Parallel running plus verification means a problem on the new platform is caught while you still have the old one, not after.

What does data ownership look like in practice?

Verito provides cloud hosting and managed IT to tax and accounting firms on dedicated private servers, where each firm gets isolated resources. Plans are month-to-month, your data is yours to retrieve, and migration is typically completed in 24 to 48 hours. That architecture makes ownership easy to act on, not just easy to claim.

On export, your data is yours and getting it is not a negotiation. On contract, month-to-month means leaving is a choice you can make any month, not a clause you wait out. On environment, a dedicated private server runs QuickBooks Desktop, Drake, Lacerte, UltraTax, and ProSeries with the same engineers handling those applications every day, and migration onto the platform is typically completed in 24 to 48 hours. Your firm also holds or co-holds the administrative credentials and the Microsoft 365 tenant, so access never depends on a single provider’s goodwill.

The track record behind it: 100% uptime since 2016, sub-60-second support response, 1,000+ firms, and a 4.9 out of 5 rating on G2. Plans start at $69 per user per month. How that compares to a platform built on switching cost:

Right or term	Lock-in platform	Data-portable host (Verito)
Data ownership in contract	Implied, not stated	Stated plainly
Export format	Proprietary or undifferentiated dump	Native files, organized structure
Release timeline	Weeks to months, often undefined	Defined, measured in days
Release or exit fee	Possible	None
Contract term	Annual, auto-renewing	Month-to-month
Environment	Shared, catalog-limited	Dedicated private server
Credentials and M365 (managed IT)	Provider is sole holder	Firm owns or co-holds
AI tooling	Bundled, hosting-only	Bring your own, portable

The setup process was smooth, and the security features give me confidence knowing my clients’ data is protected.

David Whittington, Google (Dec 2025)

The contrast is not “our features are better.” It is “your data stays yours to move.”

What should you ask any provider before you sign?

Get these answers in writing from any cloud host or IT provider. Cleaner answers signal a vendor confident you will stay because the service is good, not because leaving is hard. The first eight apply to everyone; the last two apply when a provider manages your IT or pitches a bundled AI tool.

1. Do we own our data outright, and is that stated in the contract?
2. What is the export process at termination, what format do we get, and how long does it take in business days?
3. Is there any fee to release or export our data when we leave?
4. Is the contract month-to-month or annual, and what are the renewal and cancellation terms?
5. Who owns the backups, and can we take them with us?
6. Are any tools (security, consulting, AI assistants) bundled in a way that makes them hard to drop separately?
7. Has the vendor changed ownership or packaging in the last three years, and what changed for customers?
8. What happens to a bundled tool, and to its data or history, if we drop it or leave?
9. Managed IT only: Who holds the admin credentials, Microsoft 365 tenant, and domain, and is there a transition-assistance clause covering handover and documentation?
10. Bundled AI only: Can the assistant be purchased on its own, how is our client data handled inside it, and is it excluded from any model training?

Frequently asked questions

Is Rightworks hard to leave?

Rightworks is engineered for retention, which is common for a platform assembled by acquisition under private-equity ownership. Its hosting, data tooling, firm consulting, and bundled Spark AI assistant each raise the cost of leaving. Formerly Right Networks, it has been majority-owned by a private-equity firm since 2016, assembled through a series of acquisitions, rebranded in 2023, and rolled into a continuation fund rather than sold. Its published terms offer both month-to-month and annual committed-term plans; the committed terms auto-renew for another year unless you give 60 days’ notice, and early termination means paying the balance of the remaining term. None of that is hidden, and it is a legitimate business model. The point is that a platform built by acquisition and measured on retention has every incentive to make leaving slow. Ask specifically about the contract term, the data-export process and timeline, and what happens to bundled tools if you drop the hosting.

Can a hosting provider hold my data hostage?

A provider cannot take ownership of your data, but it can make retrieval slow, costly, or format-limited through its contract and offboarding process. Long release timelines after notice have become common enough that firms now ask about exit terms up front. Ownership establishes that the files belong to you. It does not establish how fast you get them, in what format, or at what cost. That is the difference between a principle and a procedure, and only the procedure helps you on the day you leave. Get the export format, timeline, and any release fee in writing before you commit.

What is data portability and why does it matter for a tax firm?

Data portability is your ability to move files between platforms in a usable format, without losing structure or paying for them. For a tax firm it matters because your data is tied to filing deadlines and retention rules, so a slow export can put a season at risk. It makes “we own our data” something you can act on. Keep your tools portable too, so changing one vendor later does not mean changing all of them at once.

Does my IT company own my data or my credentials?

No. Your data, domain, and Microsoft 365 tenant belong to your firm, even when a managed IT provider administers them. The risk is access, not ownership: if the provider holds the admin credentials and the relationship ends badly, regaining control can be slow. Confirm in writing that your firm owns or co-holds them, plus a transition-assistance clause that obligates a clean handover.

Is Spark AI a ChatGPT wrapper?

Rightworks markets Spark as an accounting-native assistant built on leading third-party language models, with accounting-specific prompts and workflows on top. That is a domain-specific assistant built on a third-party model. The more important point is commercial, not technical: Spark is sold bundled with hosting, not as a standalone product, which ties it to the platform. If keeping the assistant means keeping the hosting, treat that as a switching cost, not a feature.

How long does it take to migrate to a new host?

The hands-on migration is usually fast once your data is in hand. Verito typically completes migration onto its platform in 24 to 48 hours. The part that takes longest is outside your new host’s control: how quickly your current vendor releases your data, which can run from days to months. Plan your timeline around the release, not the migration.

See how Verito hosts tax and accounting firms on dedicated private servers.