Your financials and IP, handled like they matter
An R&D study touches the material a company guards hardest: payroll, ledgers, product roadmaps, engineering activity, and trade secrets. So the interesting question is which controls are actually running while your study is built.
Below is what we do, stated plainly, plus what we don’t claim. Both service lines, R&D credit and cost segregation, run on the same controls.
- Taxpayer-identifying data is redacted before AI processing
- Enterprise-only model routing
- Data never trains public models
Three controls built for tax data on AI infrastructure
Generic security pages stop at encryption. These are the controls that exist because the workload is a tax study processed with AI.
These are platform behaviors, not aspirations: the same ones described on the platform page, where you can see how data moves from a connector to a finished substantiation file.
-
§7216 confidentiality, enforced in code
Taxpayer-identifying data is redacted automatically before anything reaches an AI model. The confidentiality rules that govern tax-return information are implemented as a processing step, not as a paragraph in a policy binder.
-
Enterprise AI endpoints only
In production, AI calls route exclusively through enterprise Azure AI Foundry endpoints - not consumer chat products. Your data is never used to train public or third-party models.
-
Read-only, minimal connectors
Accounting and payroll connections are read-only: we can read what a study needs and cannot write anything back. Engineering connectors collect activity metadata only - never your source code.
Concrete controls, not slogans
How your data is actually handled while a study is in flight, and, in the same table, the certifications we do not hold.
| Control | What it means for your data | Status |
|---|---|---|
| Encrypted in transit and at rest | Data moves over TLS and is encrypted at rest in storage. That applies to uploads, connector pulls, and every deliverable we issue. | Running today |
| Least-privilege access | Access is granted per engagement, on a need-to-know basis, behind strong authentication - not handed out platform-wide by default. | Running today |
| Data minimization | We ask for what the study actually requires and nothing speculative. Fewer fields collected is fewer fields exposed. | Running today |
| Your data isn’t training data | Your confidential information is never used to train public or third-party AI models. It is used to perform your study, and for nothing else. | Running today |
| Audit logging | Sensitive actions are logged, so access and activity across the platform leave a reviewable record rather than a memory. | Running today |
| Controlled document handling | Payroll files, ledgers, and technical documents are stored, transmitted, and processed inside access-restricted workflows. | Running today |
| Retention and deletion | We follow a defined retention and deletion policy and can remove your data on a documented schedule when the engagement ends. | Running today |
| Segregated environments | Each client’s data is logically segregated, and access to production is restricted and monitored. | Running today |
| SOC 2 report | We hold no SOC 2 report today, and we will not claim an attestation we do not have. | Not held |
| ISO certification | We hold no ISO certification today. | Not held |
| Independent penetration test | No third-party penetration test has been performed yet. We are preparing the scope and will report the result when one exists. | None yet |
| Formal SOC 2 examination | On our roadmap. We describe it as a commitment rather than an accomplishment. | Roadmap |
AI makes us faster, but it doesn’t get your data for free
AI accelerates intake, document parsing, computation, and first-draft narratives. It runs under governance: taxpayer-identifying data is redacted before processing, calls go through enterprise Azure AI Foundry endpoints in production, usage is metered and logged, and nothing you give us is used to train public or third-party models.
Qualification decisions, QRE amounts, and the final numbers are made by people, then reviewed and finalized by our R&D experts before the study is issued. The AI never gets the last word, which is both a quality control and a security one.
Who else handles your data
The companies below process data on our behalf to run the platform. We list them individually so your own diligence does not depend on asking.
| Sub-processor | Purpose | Data involved | Region |
|---|---|---|---|
| Microsoft Azure | Application hosting, managed PostgreSQL database, secret storage, backups, and stored documents | All customer data at rest, including tax-return information | United States (West US 2 and West US 3) |
| Microsoft Azure AI Foundry | AI model inference for drafting and review | Study text with taxpayer identifiers redacted before the call | United States (DataZone Standard deployments) |
| Microsoft Azure Document Intelligence | Text extraction from uploaded payroll and invoice documents, where enabled | Uploaded document content | United States region (written confirmation pending) |
| Cloudflare | DNS, content delivery, web application firewall, bot protection, and hosting of this marketing site | Network and request metadata; spam-check tokens | Global edge network |
| Resend | Transactional and marketing e-mail delivery | Recipient e-mail addresses and message content | Set by the provider; not pinned by us |
| Microsoft Dynamics 365 Business Central | Our CRM and accounting records | Business-contact details and billing records for our own customers | United States |
| Microsoft Entra ID | Single sign-on, for firms that enable it | Sign-in identity claims | Set by Microsoft |
| Stripe | Subscription billing, when enabled for a customer; card data never touches our servers | Billing and business metadata | Set by the provider |
| GitHub (Microsoft) | Source control and automated testing of our software | Source code and build logs; no customer data | Set by the provider |
| Data connectors you choose to connect (for example Finch, Codat, QuickBooks, and payroll providers) | Read-only retrieval of payroll or ledger data for your study, only after you authorize a connection | Employee, wage, and general-ledger data you authorize | Set by each provider |
Data processing agreements. Our policy requires, for any vendor that could receive tax-return information, terms that bar training on your data, limit retention, require US hosting, and are consistent with IRC §7216. As of the date above, a separately countersigned data processing agreement is not yet on file for these vendors; executing them is a tracked open item, and written confirmation of the Azure AI and Document Intelligence terms is part of it. We will not describe an agreement as signed until it is.
AI providers. In production, AI calls route only through Azure AI Foundry. We do not send customer data to consumer AI products.
Not active. SMS verification through Twilio is planned and not in use; it will be added here before it receives any customer data.
Changes. We update this list, and the date above, before a new sub-processor receives customer data. Customer firms can ask to be notified of additions and to raise a data-protection objection by writing to [email protected].
To report a vulnerability, e-mail [email protected] (details in our security.txt); we acknowledge reports within three business days.
Where we are - stated honestly
Because an R&D study is built from tax-return information, we design our safeguards around the expectations that apply to tax professionals handling that data - the safeguarding guidance in IRS Publication 4557, the information-security program requirements of the FTC Safeguards Rule, and the confidentiality rules of IRC §7216, which we implement as an automated redaction step rather than a policy reminder.
We maintain written information-security practices covering access, retention, and incident response, and we will walk a prospective client’s security team through them on request.
On certifications: we hold no SOC 2 report and no ISO certification today, and no independent third-party penetration test has been performed yet. A formal SOC 2 examination is on our roadmap, and we describe it as a commitment rather than an accomplishment - we won’t claim an attestation we don’t have. We also won’t tell you a system is “100% secure” or “unhackable”; nobody can. What we offer is specific controls, described accurately, and the willingness to be questioned about them.
Have a security questionnaire, a vendor review, or contractual requirements? Email [email protected] - we typically reply within one business day.
The five questions security teams ask us
Where is our data hosted, and who else touches it?
Who at Ricerca can see our financials and source data?
Is our data used to train AI models?
Can we have our data deleted when the engagement ends?
Will you complete our security questionnaire or review an NDA?
More detail lives in the Privacy Policy and the Terms of Service.
Questions about how we protect your data?
We’ll walk your team through the controls, answer your security questionnaire, and review your NDA or data-processing terms, before you share a single payroll file.