Before offshore staff can access tax return information, a firm needs to determine the applicable Section 7216 authority and configure access to match the approved workflow. Where consent is required, obtain it before disclosure. A secure connection or a server located in the United States does not replace that review.
The working question is who can see which client’s information, from where, for what purpose, and under which authorization.
Key takeaways
Determine the applicable authority before offshore staff receive live tax return information.
Where required, obtain consent before disclosure and assess special SSN conditions.
US hosting does not change the location of the person receiving the information.
Test both permitted and prohibited access at the application and document level.
Table of Contents
What needs approval before access begins?
Map the offshore person’s role and location, the return information involved, the recipient organization, and the intended work. Identify any subcontractors or support personnel who may also receive access.
The IRS consent procedure addresses disclosures to preparers outside the United States and prescribes additional Form 1040-series requirements. The applicable analysis should be completed before opening a live client file to the offshore recipient.
Keep the consent process and the vendor-security review connected, but do not merge them into a single “provider is secure” decision. A contract or security report does not by itself establish taxpayer permission.
Do Social Security numbers require a separate check?
Yes. Offshore disclosure of an unmasked taxpayer Social Security number is subject to special conditions.
Revenue Procedure 2013-14 describes the required consent treatment and adequate data-protection safeguards at both the US and offshore preparers. Masking the SSN does not remove every consent issue, and a general confidentiality commitment is not proof that the special conditions are satisfied.
Have the reviewer confirm whether the workflow needs the number, whether it can be fully masked, and what evidence establishes the required safeguards. Avoid copying prescribed consent language into a firm form without checking its full context.
Technical staff should then verify the masking and access behavior in the systems actually used. A policy stating “SSNs are hidden” is not enough if a download, report, or source document exposes them.
Why does a dedicated server not prove client-level restriction?
A dedicated environment separates the firm’s infrastructure from other customers. It does not automatically restrict each employee to particular clients inside every application.
A user may have limited access to a server while the tax application still exposes the entire client list. Document folders, downloaded files, temporary locations, and administrative permissions can introduce additional routes to information.
Test application permissions and file permissions together. If the product cannot enforce the required separation, redesign the workflow rather than assume a written instruction closes the gap.
The country where a server sits also differs from the location of the person receiving information. US hosting should not be described as a workaround for offshore consent.
A practical consent-to-access checklist
For each offshore role, document:
The legal approval and relevant consent status for the proposed information.
The client records and documents the person is permitted to access.
The approved account, device requirements, and authentication method.
Download, clipboard, printing, and local-storage rules where supported.
The person who approves access and the administrator who implements it.
The logs or other evidence available to review use.
The events that trigger suspension, reassignment, or revocation.
Use a controlled register linking client approval to authorized work assignments. Restrict who can change that register and who can grant permissions.
If consent is absent or its scope does not cover the activity, route the task for review. Staff should not bypass the restriction because a filing deadline is close.
What should happen when the proposed access is not authorized?
Keep the client assignment out of the offshore queue until the reviewer confirms a permitted route. If the taxpayer declines a requested consent, document the decision and prevent the same records from reaching offshore staff through shared folders, email or a general client list.
The workflow owner can assess an authorized domestic route or another permitted arrangement. A deadline should trigger escalation to the responsible person, not an exception that staff create themselves.
How should offshore staff be onboarded?
Start with named accounts and the minimum permissions needed for the role. Provide training on the approved systems and reporting process.
Use test clients to verify both allowed and prohibited access. Confirm that an offshore test user can perform the approved task, then attempt access to a different test client’s records and documents.
Review the outcome with the workflow owner. Record exceptions and remediate them before live information is introduced.
Follow the tax firm MFA guide for authentication and recovery responsibilities. Avoid shared accounts that prevent the firm from identifying who accessed a record.
“The firm and I use Verito every day and the security features are great, it is easy to manage.”
Denise M., Owner, RG Taxes LLC · G2, Mar 2025
How should access be reviewed and removed?
Review permissions when duties, clients, providers, or locations change, and on the firm’s defined review schedule. Check actual account and application permissions against the approved assignments.
Offboarding should address remote access, application accounts, shared files, portal permissions, active sessions, and authorized local copies. Removing one server login may leave another access path open.
Sponsored by Verito
Verito hosts Drake, Lacerte, UltraTax, and QuickBooks on private dedicated servers — with 24/7 support from techs who actually know tax software. Used by 1,000+ accounting firms.
See plans from $69/user →
Keep evidence of revocation and review any required return or deletion of information. The firm’s retention requirements and the provider agreement should be considered together.
If unexpected access is found, preserve relevant records and use the incident process rather than silently changing permissions without documenting the event.
Bring the client-level restrictions and permitted tasks to the technical discussion. Ask which controls are enforced by the hosted environment, which depend on the application, and how the firm can verify them.
The legal authorization, application permissions, and service responsibilities should all be clear before offshore staff receive live access.
“I have been using Verito for over five years to host our tax software, and it has allowed me to work easily from anywhere.”
Walter M., Owner, The Bottom Line Inc · G2, Oct 2025
Camren Majors is co-founder and Chief Revenue Officer of Verito Technologies, a cloud hosting and managed IT company built exclusively for tax and accounting firms. He is the co-author of Beyond Best Practices: Modernizing the Successful Accounting Firm (2026). His work has been featured in NATP TAXPRO Magazine and he has presented for NATP, NAEA, and NSA.
QuickBooks Desktop and a tax suite like Drake, UltraTax, Lacerte, ProSeries, or CCH can share one dedicated private server. How isolation and sizing keep it fast.
