Governance & security
A policy document says what people should do. Architecture decides what the software will do when the deadline is tomorrow and everybody is tired. We put the rules in the second place.
What constrains the design
Circular 230 governs what a practitioner may do in federal tax practice, including the diligence and competence obligations that follow you when you use a tool you did not build. COSO's guidance on internal control over generative AI governs whether the control environment around that tool is any good.
PivotSolvo is designed against both. Circular 230 alone would let you build something with no control environment at all; COSO alone would let you build a beautifully controlled system that a practitioner still cannot use. We work from the IRS Office of Professional Responsibility's introductory guidelines on responsible AI use in federal tax practice, alongside the AICPA Code and SSARS, which already cover AI-assisted work without needing an AI-specific standard.
The PivotSolvo AI Governance & Ethical Use Charter is a written document that applies to every firm on the platform. Nine sections — approved and prohibited uses, protecting sensitive data, verification, human sign-off on high-risk work, no loopholes, disclosure of material AI involvement, bias and fairness, slowing down under pressure, and escalation — plus accountability, training, a COSO mapping and a Circular 230 mapping table. It is reviewed whenever a module is added, and at minimum annually.
Available to founding firms on request.
The hard rules
These are not settings. There is no toggle, no override, and no "just this once because it's the 15th".
Nothing is filed or transmitted to a government authority automatically. Ever.
Nothing above the firm's own materiality threshold is approved without a person, and the threshold belongs to the firm.
No payment, transfer or disbursement is initiated by an agent under any circumstances.
Substantive communication reaches a client only after a person has read it. Low-stake automated reminders — a missing bank statement — are the deliberate exception.
Write-backs, filings and notice responses are approved one at a time. There is no "approve all" button, by design, and adding one has been explicitly ruled out.
The review step cannot be bypassed because the week is bad. The platform does not offer a faster path that removes a person.
Containing the agents
Assume one will. The question a firm should ask a vendor is not whether an agent can go wrong, but what the software does when it does.
Security
We would rather tell you this plainly than let you find out during due diligence.
We do not have a SOC 2 Type II report. None exists today. Strictly, SOC 2 is an attestation report rather than a certification, and nobody is "SOC 2 certified" — but however it is phrased, we do not have one, and any vendor implying otherwise about a platform this young is worth a second look.
It is on the roadmap, and dated: a Type II examination, Security and Confidentiality scope, with the observation window planned to open at the end of 2026 so the report lands well ahead of the 2027 season. We skipped Type I deliberately — a point-in-time letter would not tell you anything useful. Processing Integrity is deferred to the second year.
Until that report exists, what we can offer is this page, the charter, and a conversation with the CPA who built the thing.
Your clients, your data
Not buried, and not left to the client to infer. PivotSolvo supports disclosure through the engagement letter, a cover letter with completed returns, and a footer on financial statements — the places a client actually reads. How a firm words it is the firm's call; that it should be said is ours.
A full export, whenever you want it, without a support ticket or a notice period. A platform that is hard to leave is a platform that has stopped trying to be worth staying on.
We hold ourselves to the same confidentiality duty our subscribing firms owe their clients. Your client data is not used to demonstrate the product to anyone else — when we need to show the platform working, we show a fabricated client with planted issues, which is exactly what we do in our own investor and partner demonstrations.
Professional judgment and review cannot be removed from this work, and we do not claim to have removed them. PivotSolvo's north star is AI as the operating system of a firm rather than a tool bolted to the side of it — but the Circular 230 caveat sits in our own charter alongside that sentence, in writing, on purpose.
If a control on this page ever gets in the way of a release, the control wins. That is the whole point of writing it down before we needed it.
Early access
Founding firms get the charter, the architecture and an honest answer about what is built and what is not. Write to us.