Effective Date: June 1, 2026
Last Updated: November 4, 2026
At SortBiz Solutions, doing business as SortBiz Digital Agency (“SortBiz,” “we,” “us,” or “our”), we recognize that protecting client information is fundamental to delivering dependable business support.
Our clients may entrust us with access to business systems, internal communications, customer records, operational documentation, and other confidential information. We take this responsibility seriously.
We aim to protect information through responsible access management, secure working practices, professional confidentiality, and appropriate administrative and technical safeguards.
This policy explains our approach to information security, confidentiality, and responsible data handling across our business operations.
It complements our Privacy Policy and Terms of Service. Where a signed client agreement establishes additional or more specific security requirements, that agreement governs the relevant engagement.
1. Our Approach to Information Security
We believe effective information security begins with clear responsibilities, controlled access, and consistent professional conduct.
Our approach focuses on protecting three essential aspects of information security:
▪ Confidentiality: Protecting information against unauthorized access, use, or disclosure.
▪ Integrity: Helping maintain the accuracy, completeness, and reliability of information.
▪ Availability: Supporting authorized access to information and systems when needed.
We aim to incorporate these principles into our daily operations, client engagements, and technology decisions.
2. Confidentiality of Client Information
We recognize that client information may include sensitive commercial, operational, personal, and proprietary information.
We aim to use this information only for legitimate, authorized purposes connected to the services we provide.
2.1 Information We Treat as Confidential
Depending on the engagement, confidential information may include:
▪ Client and customer records
▪ Internal business communications
▪ Employee and contractor information
▪ Operational procedures and workflows
▪ Business plans and strategies
▪ Financial administration records
▪ Client engagement documentation
▪ Business performance reports
▪ CRM and project management information
▪ Proprietary documents and business systems
▪ Nonpublic information accessed during service delivery
2.2 Authorized Use of Information
We aim to ensure that individuals working on behalf of SortBiz:
▪ Access information only for assigned responsibilities
▪ Use client information only for authorized purposes
▪ Avoid unnecessary copying or downloading
▪ Do not disclose confidential information without authorization
▪ Respect client-specific confidentiality requirements
▪ Report suspected unauthorized access or disclosure
2.3 Confidentiality Obligations
Where appropriate, confidentiality responsibilities may be established through employment arrangements, contractor agreements, nondisclosure agreements, service agreements, or other written obligations.
We expect personnel with access to confidential information to respect the restrictions applicable to their work.
Confidentiality obligations may continue after an engagement or working relationship ends, as required by the relevant agreement or applicable law.
3. Access Control and User Permissions
We aim to limit access to client systems and information according to legitimate business requirements.
Access should reflect the responsibilities assigned to each authorized individual.
3.1 Least-Privilege Access
Our access management approach is guided by the principle of least privilege.
This means users should receive only the permissions reasonably necessary to complete their assigned responsibilities.
Depending on the system and engagement, appropriate controls may include:
▪ Role-based permissions
▪ Individual user accounts
▪ Restricted administrative privileges
▪ Limited access to sensitive records
▪ Periodic permission reviews
▪ Removal of unnecessary access
3.2 Client-Authorized Access
We request access only to systems necessary for the agreed scope of work.
Clients remain responsible for authorizing access to their systems and ensuring that permissions comply with applicable laws, contractual restrictions, and platform requirements.
Where supported, we prefer individual user accounts and delegated permissions over shared credentials.
3.3 Access Changes and Revocation
Access permissions should be reviewed when responsibilities change or an engagement ends.
We aim to coordinate the removal or adjustment of access that is no longer required.
4. Password Management and Authentication
Secure authentication helps reduce the risk of unauthorized access to business systems.
We encourage strong authentication practices for accounts used in our operations and client engagements.
4.1 Password Security
Our recommended password practices include:
▪ Using strong, unique passwords
▪ Avoiding password reuse across unrelated accounts
▪ Using reputable password management tools
▪ Avoiding passwords in unsecured documents
▪ Avoiding password sharing through ordinary email or chat
▪ Changing credentials when compromise is suspected
▪ Protecting password recovery information
4.2 Multi-Factor Authentication
We recommend multi-factor authentication (MFA) for business accounts, especially those containing sensitive information.
Where supported and appropriate, MFA may involve:
▪ Authenticator applications
▪ Security keys
▪ Device-based authentication
▪ Other supported verification methods
We encourage clients to enable MFA on systems used for shared service delivery.
4.3 Credential Handling
We aim to use approved credential-sharing methods and avoid unnecessary exposure of account passwords.
Clients should not send passwords, recovery codes, or other authentication secrets through unsecured channels.
5. Secure Remote Work and Device Security
Our services may involve remote access to business applications, cloud platforms, and client-authorized systems.
Secure remote work requires appropriate device protection, responsible network use, and awareness of common security risks.
5.1 Device Protection
Our recommended device security practices include:
▪ Using password-protected devices
▪ Keeping operating systems updated
▪ Installing relevant security updates
▪ Using appropriate malware protection
▪ Enabling automatic screen locking
▪ Restricting unauthorized device access
▪ Protecting devices against theft or loss
▪ Using device encryption where available and appropriate
5.2 Network Security
We encourage personnel to use trusted network connections when accessing business information.
Recommended precautions include:
▪ Avoiding unsecured public Wi-Fi for sensitive work
▪ Using secure connections and HTTPS-enabled services
▪ Using an approved VPN when required
▪ Protecting home and office networks
▪ Avoiding unauthorized network-sharing arrangements
5.3 Physical Workspace Security
Remote workers should take reasonable precautions to prevent unauthorized individuals from viewing confidential information.
These precautions may include:
▪ Locking screens when unattended
▪ Keeping confidential documents out of public view
▪ Avoiding sensitive conversations in public spaces
▪ Protecting printed records
▪ Preventing unauthorized access to work devices
6. Secure Communication and File Sharing
We aim to use appropriate communication and file-sharing methods when handling business information.
6.1 Business Communications
Depending on the engagement, we may communicate through approved email, messaging, meeting, and project management platforms.
We encourage personnel to:
▪ Verify recipients before sharing sensitive information
▪ Use client-approved communication channels
▪ Avoid unnecessary disclosure of confidential details
▪ Confirm unusual or sensitive requests
▪ Report suspicious messages or communications
6.2 File Sharing
We prefer controlled file-sharing methods that allow appropriate access restrictions.
Recommended practices include:
▪ Using approved cloud storage or client portals
▪ Restricting document access to authorized individuals
▪ Avoiding unnecessary public sharing links
▪ Reviewing sharing permissions
▪ Removing access when no longer required
▪ Avoiding unnecessary local copies of confidential files
6.3 Sensitive Documents
Where information requires additional protection, we may need to use specific client-approved systems or procedures.
Clients should inform us of relevant restrictions before providing access to regulated or particularly sensitive information.
7. Client Systems and Third-Party Applications
Our services may require access to client-approved business applications and third-party platforms.
These may include:
▪ Customer relationship management systems
▪ Project and task management platforms
▪ Cloud document storage services
▪ Email and communication platforms
▪ Appointment scheduling systems
▪ Marketing and campaign platforms
▪ Practice management applications
▪ Workflow automation tools
▪ AI-enabled business applications
7.1 Authorized Applications
We aim to use applications approved for the relevant engagement and consistent with the client’s requirements.
Clients remain responsible for maintaining necessary licenses, subscriptions, and permissions unless otherwise agreed.
7.2 Third-Party Security
Third-party applications operate under their own security practices, privacy policies, and contractual terms.
We consider relevant security and privacy implications when recommending or implementing applications.
We cannot independently guarantee the security or uninterrupted availability of third-party platforms.
7.3 Application Integrations
When connecting business applications, we aim to limit integrations to authorized systems and the information necessary for the intended workflow.
Integrations may require additional access controls, testing, and monitoring.
8. AI Security and Responsible Automation
SortBiz provides AI integration and workflow automation services designed to improve business efficiency.
We recognize that AI tools and automated workflows introduce additional considerations involving confidentiality, data access, accuracy, and system permissions.
8.1 Responsible AI Use
Our recommended approach to AI security includes:
▪ Using AI tools for authorized business purposes
▪ Evaluating information sensitivity before submission
▪ Avoiding unnecessary disclosure of confidential information
▪ Reviewing relevant platform privacy settings
▪ Considering third-party data processing terms
▪ Applying appropriate human oversight
▪ Following client-specific restrictions
8.2 Confidential Information and AI Platforms
Access to confidential information does not automatically authorize its submission to external AI services.
Before using AI tools to process client information, we consider the nature of the information, relevant legal restrictions, contractual requirements, and available safeguards.
Where necessary, we obtain appropriate authorization before proceeding.
8.3 Automation Security
Automated workflows may transfer information between business systems.
Recommended safeguards include:
▪ Limiting integrations to approved applications
▪ Restricting access permissions
▪ Protecting authentication tokens and API credentials
▪ Testing workflows before deployment
▪ Reviewing automated actions
▪ Monitoring errors and unexpected behavior
▪ Removing obsolete integrations
8.4 Human Oversight
We encourage human review of automated outputs and AI-generated content when errors could affect customers, business operations, legal obligations, or financial decisions.
AI-generated information should not replace professional judgment where qualified expertise is required.
9. Security Awareness and Professional Conduct
Information security depends on the decisions and actions of individuals who access business systems.
We encourage security awareness, responsible professional conduct, and familiarity with common digital threats.
9.1 Security Awareness
Relevant awareness topics may include:
▪ Password and authentication security
▪ Phishing and suspicious messages
▪ Social engineering attempts
▪ Safe file handling
▪ Secure remote work
▪ Confidentiality responsibilities
▪ Responsible AI use
▪ Reporting suspected security incidents
9.2 Phishing and Social Engineering
We encourage personnel to verify suspicious requests before sharing information, granting access, or changing payment details.
Particular caution is appropriate when requests involve:
▪ Passwords or authentication codes
▪ Financial or payment information
▪ Sensitive customer records
▪ Unusual document-sharing requests
▪ Unexpected account access changes
▪ Urgent requests from unfamiliar contacts
9.3 Professional Responsibility
Individuals working on behalf of SortBiz are expected to use authorized systems responsibly and respect the confidentiality obligations applicable to their assignments.
10. Industry-Specific Confidentiality Requirements
Some industries impose additional legal, contractual, or professional requirements for information handling.
We recognize that the appropriate safeguards depend on the nature of the client engagement and the information involved.
10.1 Tax and Accounting Firms
SortBiz provides administrative and operational support to tax and accounting practices.
Our work may involve practice management systems, client communications, engagement administration, workflow coordination, and related operational records.
We do not assume that an administrative engagement authorizes access to all taxpayer information.
US tax return information may be subject to restrictions under Internal Revenue Code Section 7216 and related regulations.
Additional requirements may apply when information is accessed, used, or disclosed by personnel outside the United States.
Before undertaking restricted activities, the relevant parties must establish the required legal authorization and appropriate contractual safeguards.
10.2 Healthcare and Other Regulated Industries
Healthcare, legal, financial, and other regulated organizations may be subject to additional confidentiality and information security obligations.
Where applicable, clients must identify relevant requirements and ensure that appropriate agreements and authorizations are in place before granting access to protected information.
SortBiz does not represent that every service or technology arrangement automatically satisfies industry-specific regulatory requirements.
10.3 Professional Service Boundaries
Unless expressly agreed and legally authorized, SortBiz does not provide tax preparation, accounting, bookkeeping, payroll processing, legal advice, financial advice, or other regulated professional services.
Our role focuses on authorized administrative, operational, marketing, and technology support.
11. Data Storage, Retention, and Disposal
We aim to limit information storage and retention to legitimate business requirements and applicable contractual or legal obligations.
11.1 Data Storage
Information may be stored in approved business applications, cloud services, or client-controlled systems.
Storage arrangements depend on the relevant engagement and the technologies involved.
11.2 Data Retention
Retention periods may depend on:
▪ The nature of the information
▪ The purpose of processing
▪ Client instructions
▪ Contractual obligations
▪ Applicable legal requirements
▪ Legitimate business recordkeeping needs
11.3 Secure Disposal
When information is no longer required, we aim to delete, anonymize, return, or securely dispose of it as appropriate.
Deletion may remain subject to applicable legal obligations, contractual requirements, and relevant backup retention periods.
11.4 Client-Controlled Information
Where clients control the systems containing their information, they generally remain responsible for their own retention settings, backup arrangements, and system administration unless otherwise agreed.
12. Security Incident Identification and Response
Despite reasonable precautions, information security incidents may occur.
We take suspected incidents seriously and aim to respond appropriately.
12.1 Potential Security Incidents
Examples include:
▪ Suspected unauthorized account access
▪ Lost or stolen work devices
▪ Accidental disclosure of confidential information
▪ Compromised credentials
▪ Malicious software or phishing incidents
▪ Unauthorized file sharing
▪ Unexpected activity in connected applications
12.2 Incident Response
Depending on the circumstances, our response may include:
▪ Identifying and investigating the incident
▪ Taking reasonable containment measures
▪ Protecting potentially affected accounts
▪ Assessing the information involved
▪ Coordinating with relevant service providers
▪ Notifying affected parties where required
▪ Addressing identified vulnerabilities
▪ Reviewing procedures to reduce recurrence
12.3 Incident Notification
Notification obligations depend on applicable laws, contractual requirements, the nature of the incident, and the information involved.
We aim to cooperate with relevant clients and authorities when notification or additional action is required.
13. Client Responsibilities for Information Security
Effective information security requires cooperation between SortBiz and its clients.
Clients remain responsible for the systems, information, and decisions under their control.
We encourage clients to:
▪ Grant access only to authorized individuals
▪ Use appropriate user permissions
▪ Enable multi-factor authentication where supported
▪ Maintain secure account recovery procedures
▪ Identify sensitive or regulated information
▪ Communicate applicable confidentiality requirements
▪ Approve third-party integrations before deployment
▪ Review user access periodically
▪ Report suspected security concerns promptly
▪ Revoke unnecessary access when engagements end
Clients should inform us of any specific security, regulatory, or contractual requirements that affect the agreed services.
14. International and Remote Service Delivery
SortBiz may deliver services remotely to businesses in different countries.
Depending on the engagement, authorized personnel may access information from locations outside the client’s country.
International access and processing may require additional safeguards or legal authorization.
We aim to address relevant requirements through appropriate contractual arrangements, client instructions, access restrictions, and other applicable safeguards.
Where information is subject to restrictions on international disclosure or access, the relevant parties must resolve those requirements before granting access.
15. Security Limitations and Continuous Improvement
No organization can guarantee absolute protection against every security threat.
Security risks evolve as technologies, business processes, and external threats change.
We aim to review relevant security practices and improve our approach as our business, services, and technology requirements develop.
Specific security commitments, service levels, incident notification deadlines, and other contractual requirements may be established in individual client agreements.
Nothing in this policy replaces applicable legal obligations or guarantees that security incidents cannot occur.
16. Related Policies
This policy complements the following SortBiz website policies:
Privacy Policy
Explains how we collect, use, share, retain, and protect personal information.
Terms of Service
Explains the conditions governing website use, professional service engagements, client responsibilities, and contractual relationships.
Where an applicable service agreement establishes additional or more specific confidentiality or security obligations, that agreement governs the relevant engagement.
17. Changes to This Policy
We may update this policy to reflect changes in our operations, technology, security practices, contractual requirements, or applicable laws.
When we make changes, we will update the Last Updated date at the beginning of this page.
Where necessary, we may communicate material changes through appropriate business channels.
18. Contact Us
If you have questions about our confidentiality practices, information security approach, or the handling of business information, please contact us.
SortBiz Solutions
Doing Business As SortBiz Digital Agency
Website: https://sortbiz.com
Email: hello@sortbiz.com
Subject: Data Security & Confidentiality Inquiry
For suspected security incidents involving our services, please contact us promptly and include sufficient information to help us assess the concern. Avoid including passwords or other authentication secrets in your message.
Our Commitment to Confidentiality
At SortBiz Digital Agency, we understand that effective business support requires more than completing tasks. It requires respecting the information, systems, and responsibilities entrusted to us.
We aim to maintain professional confidentiality, responsible access practices, and appropriate information security measures throughout our client relationships.
Authorized access. Responsible handling. Professional confidentiality.