Privacy policy

Version 2026-11 · Draft

1. Who we are

Unified Firm is online software for CPA firms in Puerto Rico, operated by DG Unified Services (“we”). Each firm decides what information about its clients it keeps. For that information the firm is responsible and we process it only to provide the service, following the firm’s instructions.

2. What we process

• Firm staff: name, email, title, license, password (stored with one-way hashing), two-factor settings, signature and initials (stored encrypted), and sign-in records (date, IP address, browser).
• The firm’s clients: what the firm enters or the client uploads through the portal: contact details, SSN/EIN (stored encrypted; usually only the last 4 digits are shown), documents, messages, invoices, deadlines, agency notices and workpapers.
• Portal users: name, email, encrypted password and sign-in codes.
• Audit log: who did what and when, for security and the firm’s professional requirements.
• Payments: processed by [Stripe / the payment processor]; we do not store card numbers.

3. Why we use it

To provide and protect the service, give support, bill the firm and comply with the law. We do not sell information, use it for advertising or share it with third parties beyond what is described here. Client tax information is used only to provide the service to the firm (see 26 U.S.C. §7216 and Puerto Rico rules; the firm is responsible for the consents those rules require).

4. AI assistant (optional)

The assistant is off until the firm turns it on, and it runs on the firm’s own Anthropic account: the firm enters its API key (or connects its Claude Team or Enterprise plan), contracts directly with Anthropic and pays it for what it uses. We do not resell that service or receive those payments.

When it is on, the application sends Anthropic (Claude), with the firm’s key, only what is needed to answer, and only for clients whose consent the firm recorded. SSN/EIN and account numbers in text are masked before they are sent; images and scanned PDFs are sent as they are only if the firm turns on “read documents”. Every request is logged in the firm’s account. The key is kept encrypted and is not shown again.

The use and retention of what Anthropic receives are governed by the terms the firm agreed with Anthropic for its account. [Recommend that each firm review Anthropic’s current commercial terms on data use and retention and, if applicable, the zero-retention agreement.]

5. Providers (subprocessors)

• DigitalOcean — servers and storage, in the United States (New York).
• [Email provider] — sending email.
• [Stripe] — subscription payments and client invoice payments.
• Anthropic — AI assistant, only if the firm turns it on, and on the firm’s own Anthropic account.
• Cloudflare (Turnstile) — bot check on the sign-up form for new firms. It receives the IP address and technical browser data of whoever visits that form; it does not receive what is typed in it or any client information.

6. Security

Encrypted connections (HTTPS), encrypted sensitive data and backups, two-factor authentication, group permissions, sign-out after inactivity, security alerts and an audit log. No system is infallible; if an incident affects personal information we will notify the firm as the law requires.

7. How long we keep it

While the firm has an account, following the retention rules the firm sets (for example, 7 years for records). When it ends, the firm can export everything; after [30] days we delete the information, except what the law requires us to keep. Encrypted backups are removed on their retention schedule.

8. Your rights

Clients of a firm should send their requests (access, correction, deletion) to their firm, which can handle them in the system. Firm staff and others can write to info@dgunifiedservices.com.

9. Cookies

We only use cookies needed for the session, security (CSRF) and “keep me signed in”. No tracking or advertising cookies. The sign-up form loads a bot check from Cloudflare, which runs in the visitor’s browser and is not used for advertising.

10. Changes and contact

If we change this policy we will tell firms with reasonable notice. Questions: info@dgunifiedservices.com.