Your portal protects client data.
This helps protect you.

How do I evaluate whether this is right for my practice?

Bring it to whoever vets your tools. The no-logs claim behind the service was independently audited by Securitum, so the central trust claim is verifiable rather than asserted. The program is structured on NIST CSF 2.0, the federal standard examiners and cyber insurers recognize, and it aligns with CISA guidance and the FTC Safeguards Rule.

A practical way to decide: if you already use a practice software secure portal and want to know what it leaves uncovered, the answer is your own credentials, your connections when you work away from the office, and the monthly record that proves your safeguards. If those three gaps matter to your obligations, this is built for them. If a technical advisor reviews it, that is exactly the kind of scrutiny we want, and the audit and framework references give them something concrete to check.

What does "all your enrolled devices" actually mean?

Client Data Safeguards protects every device where you install our software. We support Windows, Mac, iOS, and Android, with a separate download for each. Once installed, the device is enrolled, and any connection that device makes is automatically encrypted, on any network.

If you use a device for work that doesn't have the Client Data Safeguards app installed on it, that device is not protected. Most professionals install on three to five devices: their primary laptop, their phone, and any tablet or backup laptop they use for work. Some firms also deploy at the office router level for additional coverage of stationary devices.

There is no per-device fee and no device limit. Your subscription covers every device you install on.

My practice software says it's HIPAA or SOC 2 compliant. Do I still need this?

Yes, for a different reason. Your software protects data stored on its servers. Client Data Safeguards protects the connection between your device and the software. When you log in from your home network, a shared office, or anywhere else, the platform's compliance does not protect that connection. That is the specific gap Client Data Safeguards closes.

Do healthcare professionals need a BAA with their VPN provider?

For most solo practitioners, probably not, provided your VPN qualifies as a conduit under the HIPAA Conduit Exception Rule. A conduit transmits data without storing it. Our independently audited no-logs policy is the evidence that supports conduit status. We include the exact language for your risk assessment.

Do CPAs and tax preparers have a WISP deadline too?

Yes, and it has already passed. The FTC Safeguards Rule took effect June 9, 2023. It applies to any business handling consumer financial data, including CPAs, tax preparers, bookkeepers, and accountants who file returns or manage client financial records.

The updated rule goes beyond the original IRS Publication 4557 WISP requirement. Your Written Information Security Program must now name specific technology tools protecting your clients' data. It cannot just describe general practices. If your current WISP says "we use encryption" without naming the specific product, it does not meet the current FTC standard.

Client Data Safeguards provides documentation language that names the service specifically and is ready to adapt into your WISP. Subscribers should reconcile the language with their actual operating practice, ideally with their attorney or compliance advisor.

What is the Reg S-P June 2026 deadline?

The SEC's amended Regulation S-P requires investment advisors (including smaller firms) to maintain a Written Information Security Program naming specific security tools. Deadline for smaller firms: June 3, 2026. We provide documentation language that names Client Data Safeguards by reference, ready to adapt into your firm's WISP with appropriate review.

What exactly does the credential monitoring cover?

You enroll the email addresses and domain you use to access your practice systems: your EHR login, CRM, client portal. Each week, the monitoring you've enabled checks multiple breach intelligence sources, including public breach databases, active dark web markets, and stealer log feeds. If your professional credentials surface in a known breach, you see it immediately. Results are summarized in your monthly Privacy Practice Log, part of your monthly coverage record.

Does Client Data Safeguards make me fully compliant with HIPAA, Reg S-P, or the FTC Safeguards Rule?

No. Any product that claims this is overstating. Each regulation requires administrative, physical, and technical safeguards across multiple dimensions. Client Data Safeguards addresses transmission security and documentation: important components of a compliance program. The documentation we include helps you place it correctly within your broader obligations.

Who actually runs the encryption, and why should I trust it?

The encrypted connections run on CactusVPN, a privacy company that has operated since 2011, fifteen years of running production privacy infrastructure. Two things make that trustworthy rather than just asserted. First, the no-logs policy was independently audited by Securitum, a respected European security firm, so the central privacy claim is verified by a third party rather than taken on faith. Second, the underlying VPN is independently reviewed: it holds a Tier 1 ranking on a well-known public reviewer's non-sponsored tier list, the kind of rating that cannot be purchased. For client data, an engine that earns trust on the record matters more than a familiar brand name.

What framework is your safeguards program built on?

The NIST Cybersecurity Framework 2.0, released in February 2024. NIST CSF is the federal standard for managing cybersecurity risk, voluntary by design but referenced by regulators, examiners, and cyber liability insurers as the structural template for a credible security program. CSF 2.0 was broadened to apply to organizations of any size, with a companion Small Business Quick Start Guide that makes the framework usable for solo and small practices.

Your Safeguards Attestation is organized around NIST CSF 2.0's six functions (Govern, Identify, Protect, Detect, Respond, Recover) and then mapped to your profession's specific regulation: WISP and IRS Pub 4557 for tax preparers, HIPAA Security Rule for healthcare practices, Reg S-P for investment advisors, and tech-competence and confidentiality duties for attorneys. The framework does the structural work; the profession-specific citation does the regulatory work.

What does the written pricing guarantee mean in practice?

The monthly price in your subscription is contractually committed in your terms of service, not a promotional rate. Several major consumer VPN providers face active class-action lawsuits over charging subscribers at auto-renewal rates significantly higher than their original subscription price, without adequate disclosure. Your rate is locked. In writing.

I already have managed cybersecurity through my IT provider. Do I still need Client Data Safeguards?

That is great, and you should absolutely keep it. Your managed cybersecurity platform watches the device layer: it monitors your laptop and devices for malware, phishing attempts, and suspicious activity. Client Data Safeguards covers a different layer entirely. It protects the connection between your device and the systems you use, particularly when you are working remotely.

HIPAA transmission security requirements are specifically about that connection. Most practices that take compliance seriously use both, because they solve different problems. Managed cybersecurity watches what happens on your device. Client Data Safeguards protects what travels across your connection, and monitors whether your professional credentials have already appeared in breach databases or dark web markets.

My office IT provider manages our cybersecurity. Is Client Data Safeguards redundant?

Not redundant. It covers a different layer. Think of protection in three distinct zones. The device layer is where your IT provider's tools live: endpoint protection, threat detection, device management. The application layer is where your EHR, CRM, and practice software encrypt data on their own servers. The network layer (the connection between your device and those applications) is where Client Data Safeguards lives. Few IT providers or practice applications focus on that specific layer for a licensed professional's compliance obligations.

Does Client Data Safeguards protect my own personal accounts too, not just client data?

Yes, and this is worth understanding. A VPN encrypts everything traveling across your connection simultaneously. When Client Data Safeguards is active and you log into your bank, your brokerage account, or your investment portal, those connections are encrypted in exactly the same way as your client systems. It was built for your professional obligations, but it protects every credential you transmit while it is running, personal and professional alike.

This also matters for your practice staff. Every employee device enrolled in your plan has the same protection for their own accounts as they do for client systems. One subscription covers the professional layer and the personal layer for everyone in your practice.

Should I advise my clients to protect their connections too?

Yes. There are two specific recommendations worth sharing with clients who handle sensitive communications. First, a personal VPN on a client's own device encrypts their outbound connection before it reaches your practice systems. For clients who send you sensitive documents, medical information, or financial records, a consumer VPN adds meaningful protection on their end. CactusVPN's personal plan (the same audited infrastructure behind Client Data Safeguards) is a straightforward recommendation for clients who ask.

Second, advise clients explicitly that text messaging is not a secure channel for sensitive information. SMS is unencrypted and should never carry health information, financial details, social security numbers, or any other protected data. Your practice's secure messaging portal or encrypted email is the appropriate channel. Your Documentation Pack includes a plain-English client communication guide with this language included.