For tax preparers, auto dealers, mortgage brokers and lenders
Your FTC Safeguards program, organized and kept current.
The Safeguards Rule (16 CFR 314) asks covered businesses to run a written information security program. Safeguards Tracker turns every required part into a plain-English task, keeps your proof in one place, and reminds you when something comes due again.
No card needed. $49/month after the trial. Cancel any time.
See it in 45 seconds
A short tour with sample data: the checklist, keeping proof, the board report and WISP draft, teams and firms, and pricing. Music only, no narration.
Built for the businesses the rule names
Tax preparers and CPAs
Tax preparation firms are covered, and the IRS publishes a WISP guide for them (Pub. 5708).
Auto dealers that finance or lease
Dealers that arrange financing or leases for customers handle covered data.
Mortgage brokers and lenders
Non-bank lenders, brokers and servicers under the FTC's jurisdiction.
Other financial businesses
Finance companies, check cashers, and the other businesses the rule names.
What you get
Everything the rule asks for, in one checklist
Every required element, as tasks
All ten parts of 16 CFR 314.4 broken into plain-English steps, each with its citation and what to keep as proof.
Small-firm rules applied for you
Under 5,000 consumers? The items the rule exempts (16 CFR 314.6) are marked recommended instead of required.
Recurring work comes back on time
Vulnerability scans every 6 months, yearly pen test, training, and vendor reviews come due again on their own.
Evidence in one place
Attach policies, screenshots and certificates to each task. Downloads only, never shared publicly.
Your whole team
Invite staff, assign owners, and keep a training log. Every change is recorded with who and when.
A weekly nudge
One Monday email lists what is overdue and what is coming up. Nothing else.
Risk, vendor and incident registers
Score risks, track service-provider contracts, and log incidents with the FTC's 30-day notice clock.
Board report and WISP, printed
Generate the annual written report and a WISP draft from your live data. Print or save as PDF.
Up and running in an afternoon
- 1
Answer four questions
Your industry, team size, roughly how many consumers you hold data on, and who runs the program.
- 2
Work the checklist
Each task explains what to do in plain words. Assign it, mark it done, attach your proof.
- 3
Print your documents
Your annual board report and a WISP draft are built from what you recorded. Print or save as PDF.
Safeguards Tracker
$49/ month per business
or $490/year: two months free
14-day free trial, no card. Unlimited team members.
- All required elements of 16 CFR 314.4 as tasks
- Evidence storage and a full change history
- Risk, vendor, training and incident registers
- Annual board report and WISP draft
- Weekly reminder email
- Export your data any time
Firm plan
$149/ month
or $1,490/year: two months free
For accountants and IT providers who run the program for clients.
- Up to 10 client businesses, plus your own
- A separate checklist, evidence and reports for each
- Switch between clients from one login
- See who is overdue at a glance
- 14-day free trial, no card
Rather we do it for you?
Golden Rock can set it up
Our team writes your WISP and runs the program with you. Every done-for-you plan includes Safeguards Tracker.
- WISP Done-For-You (one-time)$497
- Safeguards Essentials$249 / month
Questions
Is this legal advice?+
No. Safeguards Tracker is software plus plain-language guidance written from the rule text. It helps you organize and document your program. For questions about your specific obligations, talk to a qualified attorney.
Am I covered by the Safeguards Rule?+
It applies to non-bank financial institutions under the FTC's jurisdiction, such as tax preparers, auto dealers that finance or lease, mortgage brokers, and non-bank lenders. Golden Rock's free check on our main site walks through the question.
What changes if I have fewer than 5,000 consumers?+
Section 314.6 removes four items for smaller institutions: the written risk assessment, continuous monitoring or annual pen testing with 6-month scans, the written incident response plan, and the annual written report. The app keeps them visible as recommended so you can choose.
Can I cancel any time?+
Yes. Cancel from the Billing page and you keep access until the end of the month (or year) you paid for. You can export everything as a file at any time.
Where is my data kept?+
On a Golden Rock server in Google Cloud (United States), served only over HTTPS. Evidence files are stored privately and are only ever downloaded by signed-in members of your business.