How Feather is 7216 compliant

Feather is IRC §7216-compliant AI tax software designed for CPAs, EAs, and tax attorneys. This page details every security and regulatory requirement imposed by §7216 and provides a comprehensive overview of how Feather is engineered, ensuring customers can confidently use the platform and upload client files without risk.

The product runs exclusively on Google Cloud, using Gemini Enterprise Agent Platform. Taxpayer return information is not sent to consumer Gemini, ChatGPT, or other consumer AI products. Language models are hosted only in US Google Cloud regions. The product does not accept any global or offshore regions and imposes the necessary guardrails to prevent any data from leaving the US. Document AI and observability that touch taxpayer return information are pinned the same way. Client files go to Google Cloud Storage in us-central1 region.

Queries, uploaded files, and client information are not used to train, fine-tune, or improve any AI model. According to Google's Gemini Enterprise training restriction, Google will not use your data to train or fine-tune models without prior consent. Feather operates on the Gemini Enterprise Agent Platform, which provides isolation, service-level agreements, governance, and zero data retention by default.

Fillable forms and returns are read on Feather's servers. Taxpayer values stay there. The only file sent to a model is a blank IRS template, used to label field names. If a PDF has no fillable fields, or is a scan, the filled pages go to US-hosted Document AI and Gemini Enterprise so the fields can be read. Form names and the taxpayer name and year are read from the return's own text when it is present, so a filled digital PDF is not sent for image-based reading unless pages are scanned. Tax verification then sends those extracted values to the models that review the return. SSNs, EINs, and TINs are replaced with irreversible tokens first. The same redaction runs on web-search queries and on observability traces before export.

Every query and response is logged, timestamped, and retained for 30 days. Cloud-drive reads, and exports back to Drive or OneDrive, emit a structured audit entry. User accounts, sessions, and MFA are handled by Clerk, a SOC 2 compliant authentication and identity provider. Cloud-drive OAuth credentials (Google Drive, OneDrive, Dropbox, Box) stay on Clerk's infrastructure. Feather does not store those refresh tokens. Client files go between Feather and the drive. Clerk never sees them.

Under the Terms of Service, we keep client files confidential and do not disclose them except to run the product or as required by law. Before a firm uploads a client file, it must already have the consents §7216 requires, including the written consent in Rev. Proc. 2013-14. Feather has completed a SOC 2 Type I audit, and a Type II examination is in progress. Data at rest is encrypted with AES-256. Connections use TLS 1.2+. Read more on the Security page.

For the firm's Written Information Security Plan (WISP): this page documents the 7216 controls. Pair it with the Security page for encryption, isolation, and the FTC Safeguards / IRS Publication 4557 controls.