Service Provider Addendum

Version: draft of November 9, 2026. This addendum forms part of the Terms of Service between WS SOLUTIONS LLC, a Wyoming limited liability company ("Provider"), and the firm using Taxporch ("Firm"). It sets out how Provider protects the Firm's client information. It is written to support the Firm's program under the FTC Safeguards Rule (16 CFR Part 314), IRC section 7216, and, for Canadian firms, PIPEDA and Quebec's Law 25. Text in [square brackets] is still open.

1. Definitions

• Client Data: all information about the Firm's clients and their dependents that the Firm or its clients put into Taxporch, including documents, organizer answers, messages, signatures, invoices and the audit log. Client Data includes "customer information" under 16 CFR 314.2(d) and "tax return information" under Treas. Reg. 301.7216-1(b)(3).
• Security Incident: unauthorized access to, or acquisition, use, disclosure, alteration or destruction of, Client Data, or a credible indication that the encryption keys protecting Client Data were accessed by an unauthorized person.
• Sub-processor: a third party that Provider uses to store or process Client Data.

2. Roles and instructions

The Firm controls Client Data. Provider is the Firm's service provider (16 CFR 314.2) and acts only on the Firm's documented instructions, which are these terms and the Firm's use of the service's features. Provider does not decide why Client Data is processed.

3. Use limitation

1. Provider uses Client Data only to provide, secure and support the service for the Firm.
2. Provider does not sell Client Data, use it for advertising or marketing, combine it with other customers' data for its own purposes, or use it to train or improve machine-learning models.
3. Provider discloses Client Data only to its Sub-processors as needed to provide the service, or when required by law. Provider will tell the Firm about a legal demand for Client Data unless the law forbids it.
4. Provider staff may open a client document only when the Firm asks for support on a ticket, or to investigate a Security Incident. Such access is logged in the Firm's audit log or the incident record.

4. IRC 7216 acknowledgment and penalty notice

1. Provider acknowledges that it receives tax return information from the Firm to provide auxiliary services in connection with the preparation of tax returns, and that it is therefore a tax return preparer for the purposes of IRC section 7216 and Treas. Reg. 301.7216-1.
2. Notice under Treas. Reg. 301.7216-2(d)(2). The Firm gives, and Provider acknowledges receiving, written notice that: under IRC section 7216, a tax return preparer who knowingly or recklessly discloses or uses tax return information other than as permitted can be fined up to $1,000 (up to $100,000 where the disclosure or use is in connection with identity theft), imprisoned for up to one year, or both, together with the costs of prosecution; and under IRC section 6713, a civil penalty of $250 applies to each unauthorized disclosure or use, up to $10,000 in a calendar year.
3. Provider will not use or disclose tax return information except as allowed by section 7216 and its regulations, and will not ask the Firm to obtain 7216 consents for any use by Provider beyond the service.
4. Provider flows these obligations down to every Sub-processor that can access tax return information.

5. Location and no offshore access

1. Provider stores and processes Client Data only in the United States.
2. Provider does not allow anyone outside the United States to access Client Data, including its own staff and Sub-processors, without the Firm's prior written approval. Any such approval requires the Firm's own 7216 consents where they apply, and SSNs and other taxpayer identification numbers must be masked.
3. Provider does not currently offer a Canadian data region. If it does in the future, the Firm may choose it in writing.

6. Safeguards (16 CFR 314.4)

Provider implements and maintains the following safeguards for Client Data, and keeps them at least as protective for the term of the agreement:

7. Security Incidents

1. Provider notifies the Firm's account owner by email within 48 hours of confirming a Security Incident that affects the Firm's Client Data, and follows up with updates as facts become known.
2. The notice includes, as far as known: a description of the incident; when it happened and when it was discovered; the types of Client Data involved; the number of the Firm's clients affected, broken down by US state or Canadian province of residence; whether the data was encrypted and whether keys were exposed; what Provider has done and will do; and a contact person.
3. Provider gives the Firm the information it reasonably needs to meet its own duties, including notification to the FTC under 16 CFR 314.4(j), reports to the IRS, state breach notices, and, for Canadian firms, reports to the Office of the Privacy Commissioner of Canada and Quebec's Commission d'accès à l'information.
4. Provider notifies the Firm of every Security Incident affecting its Client Data, not only those that meet a legal reporting threshold, and keeps a register of incidents for at least 5 years.
5. Provider does not notify the Firm's clients or regulators on the Firm's behalf without the Firm's agreement, unless the law requires it.

8. Sub-processors

1. The Firm authorizes the Sub-processors listed on the security page. [The final list is confirmed before launch.]
2. Provider gives the Firm at least 30 days' notice by email before adding or replacing a Sub-processor. If the Firm objects on reasonable data-protection grounds and the parties can't resolve it, the Firm may terminate and receive a pro-rata refund of prepaid fees.
3. Provider binds each Sub-processor by written contract to protections at least as strong as this addendum for the data it handles, and remains responsible for its Sub-processors.

9. Security documentation and assessments

The Firm may assess Provider as required by 16 CFR 314.4(f). Provider answers a reasonable security questionnaire once a year at no charge, provides its security overview and the summary of its latest penetration test, and tells the Firm about material changes to its safeguards. On-site audits are not included. [Further audit rights: to be decided.]

10. Return and deletion

1. The Firm can export all Client Data at any time during the agreement, including documents, signed documents with their certificates, structured data as CSV and the audit log.
2. After termination, Client Data remains available for export for 60 days. Provider then deletes it within 30 days, and backups expire within a further 30 days. On request, Provider confirms deletion in writing.
3. Records under a retention lock or legal hold set by the Firm (for example Forms 8879 for 3 years, Form T183 for 6 years) are kept until the lock ends, unless the Firm instructs otherwise in writing, in which case the Firm takes responsibility for keeping those records elsewhere.

11. Firm responsibilities

The Firm remains responsible for its own information security program (including its Qualified Individual, risk assessment, Written Information Security Plan and staff training), for deciding who in the Firm has access, for verifying clients' identity where the Firm attests to it (in-person signatures, CRA purposes), for its decision to transmit returns, for any 7216 consents for uses beyond preparing returns, and for the notices it must give to its clients and regulators.

12. Canada: PIPEDA processor terms

For Firms subject to PIPEDA or substantially similar provincial laws:

1. Provider processes Client Data only for the purposes for which the Firm collected it, and only as instructed by the Firm. The transfer is a use for processing, not a disclosure.
2. Provider protects Client Data with safeguards providing a comparable level of protection to that which the Firm must provide, as described in section 6.
3. Provider informs the Firm that Client Data is stored in the United States and may be subject to lawful access by US authorities, so that the Firm can tell its clients (suggested text is on our T183 sheet).
4. Provider notifies the Firm of every breach of security safeguards involving Client Data under section 7, so the Firm can assess real risk of significant harm, report as required and keep its own breach records for 24 months.
5. Provider helps the Firm respond to individuals' requests to access or correct their information.

Annex Q: Quebec (Law 25, section 17)

This annex applies when the Firm is subject to Quebec's Act respecting the protection of personal information in the private sector.

1. Purpose. The Firm entrusts Provider with storing and processing personal information outside Quebec (in the United States) to provide the client portal and practice-management service.
2. Privacy impact assessment. The Firm confirms it has carried out, or will carry out before using the service for Quebec residents' information, the assessment required by section 17. Provider supplies, on request, the information needed for it: hosting location, Sub-processors, encryption, access controls, retention and incident procedures.
3. Protection. Provider protects the information as set out in sections 3 to 7 of this addendum, uses it only for the mandate, and does not keep it after the mandate ends except as section 10 allows.
4. Confidentiality incidents. Provider notifies the Firm without delay, and in any case within 48 hours of confirmation, of any confidentiality incident, so the Firm can assess the risk of serious injury, notify the Commission d'accès à l'information and affected persons, and keep its incident register.
5. Access by the person in charge. Provider cooperates with the Firm's person in charge of the protection of personal information.
6. [French-language version and any further terms required in Quebec: to be decided with Quebec counsel.]

Annex S: Contact points

• Provider security and privacy contact: support@taxporch.com [named person to be added].
• Firm contact: the account owner, unless the Firm names another person in Settings.