Security

Precision-Engineered for Privacy, Security, and Compliance

Privacy and security are embedded into our tax solutions through documented controls, governance, and ongoing oversight. Independent SOC 2 assessments validate the effectiveness of their security controls in protecting sensitive data.Our proprietary tools are continuously monitored, regularly tested through third-party security assessments, and supported by a formal Vulnerability Disclosure Program that enables responsible reporting and remediation of potential security issues. These practices align with recognized industry standards and evolve as risks and regulatory expectations change, providing sustained confidence in how your critical tax data is protected.

Resources

Insights

Resources

Events

Press Room

Product Security Profiles

Access SOC 2 reports, penetration test summaries, and security attestations for each product. If you have a confidentiality agreement with Ryan, you can view documentation immediately through your profile. New clients and customers can request access by completing a nondisclosure agreement.

Certifications
Certified Product Security Compliance
Legal Resources
View Our Legal Resources and Security Commitments
Corporate Responsibility
Investing in Our Shared Future: Corporate Responsibility
LEARN MORE
Accessibility Standards
Accessibility Standards and Inclusive Design
Ryan designs tax products and web platforms to meet Americans with Disabilities Act (ADA) and Web Content Accessibility Guidelines (WCAG) 2.1 standards, ensuring equal access for all users.
By incorporating accessibility widgets and inclusive user experience design practices, Ryanʼs tax technology accommodates diverse needs and abilities.
Through ongoing testing, user feedback collection, and continuous improvement efforts, Ryan maintains and strengthens accessibility compliance across all platforms, making tax technology accessible to everyone regardless of physical or cognitive differences.
Attestation and Compliance
Attestation and Compliance
We are committed to maintaining the highest standards of administrative and technical control. Service Organization Control (SOC) 2 Type II report documents demonstrate that an independent accounting and auditing firm examined an organizationʼs control objectives and activities and tested those controls to ensure that they are operating effectively.
SOC 2 is a technical auditing process conducted by an independent accounting and auditing firm to measure the security of an organizationʼs unique data processing systems. SOC 2 Type II provides a neutral determination regarding whether effective safeguards and controls are in place.
Our SOC 2 Type II reports verify the existence of internal controls that have been designed and implemented to meet the AICPA Trust Services Criteria for security. You can obtain copies of our product-specific SOC reports and other security documentation by visiting our Product Security Profiles.
We perform background screening on all team members to the extent possible within local law. Team members also sign nondisclosure agreements. Additionally, all team members annually affirm their compliance with the company handbook, data privacy, and security policies.
Upon joining and at least annually thereafter, all Ryan team members undergo tested security training. This training covers safe handling and classification of data, compliance, security best practices, and adherence to the principle of least privilege.Regular training and testing on phishing are provided through an internal mock phishing program, which includes reinforcement training for underperformance. Upon joining and at least annually thereafter, all Ryan team members undergo tested privacy training covering topics such as personal data, personally identifiable information, and sensitive personal information as regulated by various applicable privacy laws [specifically including the General Data Protection Regulation (GDPR) and California privacy laws].Specific Ryan team members receive additional role-based training. For example, the Ryan software engineering team receives training on how to identify the latest threats and use secure coding techniques to build resilient and secure solutions, with special emphasis on privacy by design and secure software development.
Ryan platform security is overseen by a Cyber Security team led by a Chief Information Security Officer (CISO). The Cyber Security team maintains an Incident Response Plan (IRP) that addresses the segregation of duties, details the processes for detecting, reporting, identifying, analyzing, and responding to security incidents impacting firm infrastructure and data under our custody and control, and provides for post-event analysis to identify and capture any lessons learned.
We may engage subprocessors to perform or deliver services. In such cases, we only grant these subprocessors access to client and customer data as required to perform their services. These subprocessors are bound by written agreements that impose strict data protection measures mandated by Ryan and applicable regulations.The Ryan written agreements with subprocessors ensure that the level of data protection provided is no less stringent than the level of data protection specified in the client’s or customerʼs agreement with Ryan. Furthermore, we subject certain vendors to vendor assessments to verify the implementation of proper data security and privacy practices throughout the vendor relationship. Any changes to vendor services or existing contracts undergo a security risk assessment to ensure that they do not introduce additional or undue risk.
Technical and Organizational Measures
Integrated Technical and Organizational Safeguards
Security at Ryan goes beyond theory, with encryption, monitoring, policies, and governance operating together as an integrated protection framework. A BitSight Security Rating of 760, above the 710 industry average, independently validates Ryanʼs cybersecurity readiness.
The BitSight Security Rating is an independent, data-driven assessment of cybersecurity readiness.BitSight is the most widely adopted Security Ratings solution for all industries and markets, and is trusted by 20% of Fortune 1000 companies, the Big 4 accounting firms, and numerous global insurance companies.Additional information on Security Ratings may be found at BitSightʼs website.
We store critical information in high-security data centers, including cloud storage providers. Data center security includes physical security measures designed to minimize disruption and prevent theft, tampering, and damage, including:
24×7 monitoring
Cameras
Visitor logs
Entry requirements
Climate control
Fire detection and suppression systems
Dedicated cages to separate our equipment from other tenants in the data center
We maintain an internal policy governing the proper use and protection of client and customer data. We further maintain an internal Record Retention and Disposal policy developed in view of industry-standard compliance requirements such as the GDPR.Where appropriate, platforms use built-in rules to govern retention and Ryan team members follow operational guidelines for the deletion of data upon termination of services. When deleted, data is irrevocably logically and physically deleted according to the protocols of best-in-class hosting service providers.
We use best-in-class hosting service providers with resilient and redundant systems to enable automated failover capability. Our framework focuses on three core elements:
People: We maintain policies and procedures for Incident Response and train our Cyber Security team on these documents.
Processes: We maintain a program for business continuity to sustain certain operations during a significant business disruption.
Technology: We use a prioritized approach to restoring essential information technology infrastructure, hardware, and software during a business continuity event.
We perform regular and secure backup and recovery testing of data and supporting systems. The intervals for backups depend on the type of data and underlying repositories, ranging from minutes to daily.
We employ a robust, multilayer defense-in-depth strategy for safeguarding against intrusions and malware. The security architecture is designed to centrally manage and monitor the protection of company assets as well as client and customer data.Furthermore, we require vendors determined to be “high risk” to complete vendor assessments to verify the implementation of proper data security and privacy practices throughout the vendor relationship. Any changes to vendor services or existing contracts undergo a security risk assessment to ensure that they do not introduce additional or undue risk.
We limit access to client and customer data to authorized team members with login credentials. Security is enhanced through multifactor authentication (MFA), single sign-on, need-to-know/least-privilege principles, and restricted administrative account access.Strong password controls enforce length, complexity, and defined expiration, with limited reuse. To strengthen security, we implement session expiration, terminating inactive sessions to prevent unauthorized access. Failed login attempts result in account lockouts to thwart brute-force attacks. Regular access reviews are conducted to help ensure access privileges remain appropriate and up to date. Lastly, we promptly revoke access upon employee termination, further preventing unauthorized data access.

Frequently Asked Questions

Ryan maintains SOC 2 certification verified through independent accounting and auditing firm examinations. SOC 2 measures data processing system security and determines whether effective safeguards are in place. Reports verify internal controls meet AICPA Trust Services Criteria for security. Ryan also maintains PCI DSS compliance for secure payment processing. Product-specific SOC reports and security documentation are available through Product Security Profiles.
Data encryption uses TLS enabled by default on internet-accessible systems. Internal policies govern data use and protection, with retention and disposal aligned with GDPR. Access is limited to authorized team members through MFA, single sign-on, and least-privilege principles. Strong password controls, session expiration, and account lockouts prevent unauthorized access. Additionally, SIEM tools provide centralized logging and monitoring. Data centers have 24x7 monitoring, cameras, visitor logs, controlled entry, and dedicated equipment cages. Deleted data is irrevocably logically and physically deleted per hosting provider protocols, ensuring database security and privacy.
Third parties are regularly contracted to simulate attacks through penetration testing to identify weaknesses. Ryan participates in a bug bounty program to incentivize responsible vulnerability reporting. SIEM tools continuously monitor and identify security events and anomalous behavior in real time. BitSight provides an independent cybersecurity assessment, with Ryan maintaining a 720 rating versus the 710 industry average.
Ryan engages subprocessors to perform services, granting data access only as required. Written agreements impose strict data protection measures mandated by Ryan and regulations, ensuring protection levels no less stringent than those contained in our agreements. Certain vendors undergo assessments verifying proper data security and privacy practices. Service or contract changes undergo a security risk assessment to prevent additional risk.

Get in Touch

Transform tax into a strategic advantage with deep expertise and innovative technology—explore our services or request a software demo.

Accessibility Standards and Inclusive Design

Ryan designs tax products and web platforms to meet Americans with Disabilities Act (ADA) and Web Content Accessibility Guidelines (WCAG) 2.1 standards, ensuring equal access for all users.

By incorporating accessibility widgets and inclusive user experience design practices, Ryanʼs tax technology accommodates diverse needs and abilities.

Through ongoing testing, user feedback collection, and continuous improvement efforts, Ryan maintains and strengthens accessibility compliance across all platforms, making tax technology accessible to everyone regardless of physical or cognitive differences.

Attestation and Compliance

We are committed to maintaining the highest standards of administrative and technical control. Service Organization Control (SOC) 2 Type II report documents demonstrate that an independent accounting and auditing firm examined an organizationʼs control objectives and activities and tested those controls to ensure that they are operating effectively.

SOC 2 is a technical auditing process conducted by an independent accounting and auditing firm to measure the security of an organizationʼs unique data processing systems. SOC 2 Type II provides a neutral determination regarding whether effective safeguards and controls are in place.

Our SOC 2 Type II reports verify the existence of internal controls that have been designed and implemented to meet the AICPA Trust Services Criteria for security. You can obtain copies of our product-specific SOC reports and other security documentation by visiting our Product Security Profiles.

Frequently Asked Questions

Ryan maintains SOC 2 certification verified through independent accounting and auditing firm examinations. SOC 2 measures data processing system security and determines whether effective safeguards are in place. Reports verify internal controls meet AICPA Trust Services Criteria for security. Ryan also maintains PCI DSS compliance for secure payment processing. Product-specific SOC reports and security documentation are available through Product Security Profiles.
Data encryption uses TLS enabled by default on internet-accessible systems. Internal policies govern data use and protection, with retention and disposal aligned with GDPR. Access is limited to authorized team members through MFA, single sign-on, and least-privilege principles. Strong password controls, session expiration, and account lockouts prevent unauthorized access. Additionally, SIEM tools provide centralized logging and monitoring. Data centers have 24x7 monitoring, cameras, visitor logs, controlled entry, and dedicated equipment cages. Deleted data is irrevocably logically and physically deleted per hosting provider protocols, ensuring database security and privacy.
Third parties are regularly contracted to simulate attacks through penetration testing to identify weaknesses. Ryan participates in a bug bounty program to incentivize responsible vulnerability reporting. SIEM tools continuously monitor and identify security events and anomalous behavior in real time. BitSight provides an independent cybersecurity assessment, with Ryan maintaining a 720 rating versus the 710 industry average.
Ryan engages subprocessors to perform services, granting data access only as required. Written agreements impose strict data protection measures mandated by Ryan and regulations, ensuring protection levels no less stringent than those contained in our agreements. Certain vendors undergo assessments verifying proper data security and privacy practices. Service or contract changes undergo a security risk assessment to prevent additional risk.

Security

Precision-Engineered for Privacy, Security, and Compliance

Product Security Profiles

Certified Product Security Compliance

View Our Legal Resources and Security Commitments

Investing in Our Shared Future: Corporate Responsibility

Accessibility Standards and Inclusive Design

Attestation and Compliance

Background Checks

Awareness and Education Program

Incident Management

Data Breach Notification

Vendor Management

Integrated Technical and Organizational Safeguards

Security Rating

Data Center

Data Encryption

Data Protection and Records Management

Availability Control, Backup, and Recovery

Intrusion and Malware Protection

Logging and Monitoring

Identity and Access Control

Secure Design Reviews and Threat Modeling

Patching

Penetration Testing

Vulnerability Disclosure Program

Frameworks

Frequently Asked Questions

What certifications or compliance standards does Ryan maintain?

How does Ryan protect data across its platforms?

How often are Ryanʼs systems tested for vulnerabilities?

Who can submit a vulnerability report and how?

Does Ryan use subprocessors or third-party vendors?

How does Ryan handle data retention and deletion?

Precision-Engineered for Privacy, Security, and Compliance

Product Security Profiles

Certified Product Security Compliance

View Our Legal Resources and Security Commitments

Investing in Our Shared Future: Corporate Responsibility

Accessibility Standards and Inclusive Design

Attestation and Compliance

Background Checks

Awareness and Education Program

Incident Management

Data Breach Notification

Vendor Management

Integrated Technical and Organizational Safeguards

Security Rating

Data Center

Data Encryption

Data Protection and Records Management

Availability Control, Backup, and Recovery

Intrusion and Malware Protection

Logging and Monitoring

Identity and Access Control

Secure Design Reviews and Threat Modeling

Patching

Penetration Testing

Vulnerability Disclosure Program

Frameworks

Frequently Asked Questions

What certifications or compliance standards does Ryan maintain?

How does Ryan protect data across its platforms?

How often are Ryanʼs systems tested for vulnerabilities?

Who can submit a vulnerability report and how?

Does Ryan use subprocessors or third-party vendors?

How does Ryan handle data retention and deletion?