Custom accounting firm software in Baltimore: the one clause no size exemption lets you out of

There is a question we have started asking early in conversations with accounting firms, because the answer tells us almost everything about how the practice is run. It is not about software. It is this: how many separate companies can currently open a file containing one of your clients' Social Security numbers, and when did you last check any of them? Nobody has ever answered it from memory. Most people start counting on their fingers, get to six, pause, remember the backup provider, get to eight, remember that the phone system emails voicemail transcripts, and then stop counting and say something like more than I would like.

That is not carelessness. It is the natural result of twenty years of good products being sold one at a time to a profession that adopts them one at a time. Every one of those purchases was defensible. The aggregate is a compliance object nobody designed and nobody owns, and it happens to be the exact object that federal law and Maryland law both regulate directly and by name.

This is the nineteenth trade we have taken apart in this series, and it is the first one where the business we are writing about is legally a financial institution. That is not a metaphor and it is not our reading. It is a worked example inside the rule itself. Everything else in this piece — the seat arithmetic, the meters, the storefront, the build-or-buy call — follows from that one fact, so we should start there. But first, the market, because the shape of Baltimore's accounting sector is strange in a way that turns out to explain a lot about why the software fits so badly.

What Baltimore's accounting market actually looks like

We do not like quoting trade association headcounts, so we counted instead. The Census Bureau's County Business Patterns program publishes an establishment-level file by county and industry code, and accounting occupies four adjacent codes: 541211 for offices of certified public accountants, 541213 for tax preparation services, 541214 for payroll services and 541219 for other accounting services, which is where most bookkeeping practices land. Taken together, the 2023 file gives Maryland 2,447 establishments with paid employees, 19,224 employees and roughly $1.571 billion in annual payroll.

Baltimore City sits sixth on establishment count and third on employment, and that gap is the whole story. Narrow to CPA offices alone and it gets sharper: the city has 55 offices employing 1,876 people, an average of 34.1 each, against Baltimore County's 10.6, Montgomery's 10.3, Howard's 6.5 and Carroll's 4.4. Payroll runs the same way. The city pays $120,914 per CPA-office employee against Carroll's $54,308, a 2.2-to-1 spread across a forty-minute drive.

What that describes is a barbell. Downtown holds a dense cluster of large regional and national offices with real IT departments, procurement processes and somebody whose actual job is vendor risk. Everywhere else there is a long tail of two-to-six person practices doing the same regulated work, holding the same regulated data, under the same rules, with none of that apparatus. The software market serves the first group well. This piece is mostly about the second. Carroll County is the one number in that table we would not build an argument on — 73 establishments carrying 1,787 employees means one or two large back-office operations are sitting inside the county figure and dragging the average up, so treat that row as a curiosity rather than a description of Westminster's accounting trade.

One caveat matters more than the rest, and we would rather state it than bury it: County Business Patterns counts only establishments with paid employees. Every one-person practice that runs with no payroll — and in tax preparation that is a very large share of the trade — is invisible in this file. For a sense of the scale that is missing, the IRS reported 836,852 individuals holding a current preparer tax identification number as of March 1, 2026, of whom 201,602 are CPAs, 66,503 are enrolled agents and 24,097 are attorneys. That is 292,202 credentialed preparers out of 836,852 — roughly 65 percent of the people legally preparing returns for money in America hold no professional credential at all, which is precisely the population Maryland built a separate registration board to cover, and we will come back to that.

The one industry where the Census catches the peak

Here is a methodological quirk that turns out to be substantive. County Business Patterns takes its employment count from the pay period including March 12. For a warehouse or a veterinary practice, that is an arbitrary week in a fairly flat year. For tax preparation it is the annual peak — dead center of filing season, three weeks before the individual deadline, when every seasonal desk in the building is occupied.

So the tax preparation numbers are not an average. They are close to a high-water mark, and the payroll figure sitting next to them is for the whole year. Divide one by the other and the effect is unmistakable. Maryland's 414 tax preparation establishments report 1,585 employees and $42.6 million of annual payroll — $26,869 per peak-season employee. The state's 1,046 CPA offices report 9,973 employees and $1.043 billion of payroll, which is $104,591 per employee. Same statistical series, same state, same year, and a 3.9-to-1 ratio.

Nobody in tax preparation is paid a quarter of what an accountant is paid. The ratio is not a wage gap. It is a calendar, showing up in the arithmetic because the Census counts heads in March and money in December.

Hold that thought, because in a moment we are going to price software that is metered per head, billed for twelve months, and sold to an industry whose head count in March bears no relation to its head count in September.

The rule that made your firm a financial institution

The Safeguards Rule is codified at 16 CFR Part 314. It implements section 501(b) of the Gramm-Leach-Bliley Act, it was rewritten at 86 FR 70307 on December 9, 2021, its main compliance date was June 9, 2023, and it was amended again at 88 FR 77508 on November 13, 2023 to add breach notification. Most accountants have heard of it. In our experience a good number believe it applies to banks, and to them only in some diluted, aspirational sense.

It does not work that way, and the rule goes out of its way to say so. Section 314.1(b) sets out the scope and names the kinds of business the Commission regulates, and the list includes tax preparation firms outright. If that leaves any doubt, Section 314.2(h)(2) supplies thirteen worked examples of what a financial institution is, and the eighth of them is not subtle:

"An accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution because tax preparation services is a financial activity listed in 12 CFR 225.28(b)(6)(vi) and referenced in section 4(k)(4)(G) of the Bank Holding Company Act of 1956, 12 U.S.C. 1843(k)(4)(G)." — 16 CFR §314.2(h)(2)(viii)

There is no headcount floor in that sentence, no revenue floor, and no small-firm carve-out. A sole practitioner working from a spare room in Hampden and preparing sixty returns a season is a financial institution on precisely the same terms as a hundred-person firm on Pratt Street. So is a bookkeeping practice that also does returns. So, in most readings, is the tax desk inside a law firm.

What follows from that is a program, not a policy document. Section 314.3(a) requires a comprehensive information security program written in one or more readily accessible parts, with administrative, technical and physical safeguards appropriate to your size and complexity. Section 314.4 then lists the elements: a named Qualified Individual, a risk assessment, access controls with least privilege, encryption of customer information in transit over external networks and at rest, secure development or evaluation practices for the applications you use, multi-factor authentication for anyone accessing an information system, secure disposal no later than two years after last use, change management, activity logging, testing, training, service provider oversight, an incident response plan, an annual report, and — since May 13, 2024 — notification to the FTC within 30 days when a breach touches at least 500 consumers.

Read as a block that is intimidating, and this is usually where a small firm decides the whole thing must be aimed at somebody else. Which brings us to the most useful paragraph in the rule.

The exemption that is not the one you were hoping for

Section 314.6 is a single sentence long and it is the entire small-firm accommodation:

"Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers." — 16 CFR §314.6

That is a real and generous accommodation. It releases a firm under five thousand consumers from the four requirements a small practice genuinely cannot carry: the formal written risk assessment with documented evaluation and categorization criteria, the continuous monitoring regime or its alternative of annual penetration testing plus vulnerability assessments every six months, the written incident response plan with defined roles and decision authority, and the Qualified Individual's annual written report to a board or governing body. Those four are where the consultants' invoices live, and a two-partner firm in Towson is out from under all of them.

Now read what the sentence does not say. It names four paragraph references. It does not name Section 314.3(a), or 314.4(a), or (c), or (e), or (g), or (j) — and it does not name Section 314.4(f).

Section 314.4(f) has three limbs, and firms typically satisfy the first by accident and neither of the others at all. You must take reasonable steps to select and retain service providers capable of maintaining appropriate safeguards. You must require them by contract to implement and maintain those safeguards. And you must periodically assess them based on the risk they present and the continued adequacy of their safeguards. Buying from a well-known vendor covers the first limb in substance. The second is a contract term, and the third is a recurring task with an evidence trail.

The reach of the word is what makes this bite. Section 314.2(r) defines a service provider as any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to you. Not the vendors you think of as security-relevant. All of them. The tax engine, the practice management platform, the document portal, the e-signature and identity verification provider, the cloud host, the backup service, the outsourced IT firm, the payroll platform, the client's bookkeeping ledger you have accountant access to, the payment processor, the email tenant, and the voice-over-IP provider that helpfully emails you a transcript of a client reading out their Social Security number.

Count the ones that touch client data in your own firm and the number is usually eleven to fourteen. Every one of them needs a contract clause and a periodic, risk-weighted assessment you can produce on request. And the firm that is most exposed to that arithmetic is the smallest one, because it has the same vendor count as a mid-size firm and nobody at all whose job this is.

Maryland asked for the same clause fourteen years earlier

If the federal rule were the whole story, a Baltimore firm could work through it once and be done. Maryland has its own statute, it is older, and on the vendor question it says something remarkably similar in different words — which means compliance with one is evidence toward the other, and a gap in one is a gap in both.

The Maryland Personal Information Protection Act sits at Commercial Law Title 14, Subtitle 35. Section 14-3503(a) requires a business that owns, maintains or licenses personal information of a Maryland resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information and the nature and size of the business and its operations — a proportionality test, not an exemption. Then comes the clause:

"A business that uses a nonaffiliated third party as a service provider to perform services for the business and discloses personal information about an individual residing in the State under a written contract with the third party shall require by contract that the third party implement and maintain reasonable security procedures and practices…" — Md. Commercial Law §14-3503(b)(1)

Section 14-3503(b)(2) applies that to every written contract entered into on or after January 1, 2009. Maryland was asking accounting firms to bind their vendors by contract more than fourteen years before the FTC's version took effect. If your engagement with a document portal was signed in 2016 and has no security clause, that is not a new problem created by a 2023 federal rule. It has been a problem in Maryland the entire time.

The definition of personal information is worth reading closely too, because Section 14-3501(e)(1)(i) lists the data elements that trigger the subtitle, and the first of them is a Social Security number, an Individual Taxpayer Identification Number, a passport number or other federal identification number. An ITIN is named in the statute. For the Baltimore practices that serve immigrant clients and file heavily with ITINs — a real and underserved segment of this city's tax trade — the statute is not adjacent to their work. It is a description of their filing cabinet.

The crossing point: one breach, two clocks

Here is the part we have not seen written down anywhere, and it is the single best reason a Baltimore accounting firm cannot get its compliance posture out of a national product.

A firm that prepares returns holds personal information it owns and licenses. Under Section 14-3504(b)(3), if that information is breached, notification to the individual must be given as soon as reasonably practicable and not later than 45 days after discovery. Fine — every checklist knows about the 45-day clock.

But the same firm doing outsourced bookkeeping, controller work or payroll for a business client is holding that client's employee and customer data. It does not own or license that information; it merely maintains it. And Section 14-3504(c) addresses exactly that posture:

"A business that maintains computerized data that includes personal information of an individual residing in the State that the business does not own or license, when it discovers or is notified of a breach of the security of a system, shall notify, as soon as practicable, the owner or licensee… not later than 10 days after the business discovers or is notified of the breach." — Md. Commercial Law §14-3504(c)(1)–(2)

So the same firm, on the same morning, from the same incident, can be running two entirely different statutory clocks — 45 days on the folders it owns and 10 days on the folders it holds. Which clock applies to any given file is not a property of the file. It is a property of the engagement the file belongs to, and engagements are not modeled that way in any practice management platform we have looked at. The two subsections also point in opposite directions: (c)(3) requires you to share breach information with the owner, and (c)(4)(i) forbids you from charging them a fee for it.

And the mirror image is true. When your firm does that bookkeeping work, you are the nonaffiliated third-party service provider that Section 14-3503(b)(1) requires your client to bind by contract — and, under Section 314.2(r), a service provider to any of your clients who are themselves covered financial institutions. Which means your own engagement letters are somebody else's compliance evidence, and increasingly their counsel will ask to see the clause.

We are builders, not your counsel, and a firm with a mixed practice should put this in front of a Maryland lawyer in writing rather than take our word for it. But the practical consequence is a design problem regardless of how counsel reads it: somewhere in your systems, every client folder needs to know which engagement it belongs to and therefore which clock it is on — and that is a field, a report and a drill, not a policy paragraph.

What the meter actually costs

Now the money. We should start by being fair: this market publishes prices better than almost any trade we have surveyed. Hotels gave us one price out of sixteen. Independent pharmacy gave us zero out of thirty. Accounting gave us seven self-serve prices out of twenty-six products checked on August 4, 2026, several of them with the full feature ladder alongside. That is a market that respects its buyers, and we would rather say so than manufacture a grievance.

Two details in that table are worth pulling out. Karbon and Canopy both charge a premium for the flexibility of monthly billing — Karbon's Team plan is $59 paid annually and $79 paid monthly, a 34 percent step, and Canopy's page states plainly that annual billing saves 20 percent. And Financial Cents notes on its own pricing page that a minimum of five users is required for monthly billing, which quietly puts the flexible option out of reach of exactly the firms most likely to need it.

Now the arithmetic that matters. Take a nine-person firm in the Baltimore metro — right at the Baltimore County average from our first table. Five people work year-round: two partners, a staff accountant, a bookkeeper and an administrator. Four are seasonal preparers and reviewers who come in around January 15 and finish shortly after April 15, about fourteen weeks.

Annual billing prices your peak, because you cannot buy a seat for a quarter of a year. So you buy nine seats for twelve months. That is 108 seat-months. The work consumes five seats for twelve months plus four seats for 3.23 months, which is 72.9. The difference is 35.1 seat-months — 32.5 percent of everything you pay — and it buys nothing at all.

Read the bottom two rows together, because that is the finding. Commit annually and you throw away $4,876 on seats nobody sits in. Flex monthly and you avoid most of that, but you then pay a premium of 20 percent at Canopy and 31 percent at SmartVault on every seat you genuinely use, and you end up $2,808 above the fair number anyway. There is no third option on the menu. Flexing recovers only about 42 percent of the loss, and this is not a vendor being greedy — it is a meter designed in good faith for a business with a stable roster, applied to a business whose roster is a seasonal hydrograph. The Census told us that in the first section; the invoice tells you again every January.

Per-seat pricing asks how many people you employ. A tax practice does not have an answer to that question. It has two answers, and they are four months apart.

The meters that do not count seats at all

Seats are the meter everyone negotiates. They are increasingly not the meter that costs the most. Look at what sits underneath the per-user line on the same published pages.

Canopy's Service Power-Ups are priced per client rather than per user. Tax Workflow Automation starts at $34 per credit per client, annual billing, with volume discounts available. Close Automation is $10 per connected client per month with the first five connections included. Tax Resolution goes back to $50 per user per month. Identity verification is metered a third way again: $1.25 per knowledge-based authentication credit, with five trial credits included and volume discounts and tiered pricing available.

Run those against our nine-person firm. Suppose it serves 400 individual clients. The per-seat practice management line is $7,992 a year. The per-client tax workflow add-on at list is 400 × $34 = $13,600. Before any volume discount — and Canopy is explicit that discounts exist, so the real figure will be lower — one add-on priced per client costs about 1.7 times the entire platform priced per user. The number you negotiated hardest is not the number that decides your bill.

The identity verification line is stranger still, and it is worth understanding because it is a legal requirement rather than a convenience. IRS Publication 1345 governs electronic signatures on Forms 8878 and 8879, and where the taxpayer signs remotely the preparer must verify identity through third-party knowledge-based authentication. The IRS states the rule and its limits plainly:

"Identity verification must be completed every time a taxpayer electronically signs Form 8878 or 8879, with two exceptions. If a taxpayer e-signs the form in the physical presence of the ERO, and the taxpayer has a multi-year business relationship with the ERO, then no further identity verification is needed." — IRS, e-file signature authorization guidance

Follow that through. A joint return needs both spouses authenticated separately, so 400 individual returns of which 180 are joint means 580 signatures. At $1.25 that is $725 — except the multi-year exception means your established clients drop out. If sixty of those clients are new this year and 27 of those are joint, the recurring bill is 87 credits, or $109. The KBA line is not an operating cost. It is a growth tax, charged per new human at $1.25 a head, and it is the only line in the stack that gets cheaper the less your firm grows.

And then compare products. Intuit bundles the same regulatory step into every ProSeries tier — the pricing page lists "Digital signatures and KBAs for all tax clients" on pay-per-return at $539 a year, on Basic 1040 at $729 and on Professional at $2,605 — while a practice management platform meters it by the credit. Neither is wrong. But it means two firms doing identical work under an identical IRS requirement can have that requirement appear as a bundled feature in one budget and a variable per-head charge in another, and no feature comparison grid will ever show you that, because it is not a feature difference. It is a meter difference.

Being fair to the platforms

We write a version of this section in every one of these pieces, and here it is more deserved than usual.

The accounting practice management market solves genuinely hard problems, and it solves several of them better than a custom build ever would at a sane price. Recurring work templates that spawn 400 job instances on January 2 and track them to completion; capacity views that tell a partner in February which reviewer is underwater; client request lists that chase themselves and stop chasing the moment the document lands; a portal clients will actually log into. Karbon's email triage genuinely changes how a team works. TaxDome's all-in-one bundling is a real answer to stack sprawl. Canopy's transcript pulling saves hours nobody enjoys. If your firm is happy on its platform, the correct advice is to stay there, and we say so to people who ring us up expecting to hear otherwise.

There is also a compliance argument for consolidation that the platforms are entitled to make and, oddly, rarely do. Every additional vendor that touches client data is another Section 314.4(f) contract to negotiate, another periodic assessment to schedule and evidence, and another Section 14-3503(b)(1) clause to get right. A firm running four products instead of eleven has genuinely less compliance surface, not just fewer logins. When TaxDome says the all-in-one saves you money, the honest version of that claim is not really about subscription arithmetic. It is that vendor count is itself a regulated quantity, and reducing it reduces work you are legally required to do. That is a better argument than the one on the billboard.

Where the market is weakest is not features and not price. It is that these are national products serving fifty states, and they model the parts of your practice that are the same everywhere. Job status is the same in Baltimore and Boise. Which of two Maryland breach clocks applies to a particular folder is not, and it never will be worth a national vendor's engineering time to model it — there is no version of that roadmap where Maryland wins the prioritization meeting.

The part no national platform models

Beyond the two statutes, Maryland runs its own regulatory plumbing for this trade, and some of it is wired together in ways that surprise people.

Two regulators, one profession, and a five-day wire between them

Maryland regulates the people who prepare returns through two separate bodies. Certified public accountants fall under the Board of Public Accountancy. Everybody else who prepares individual returns for compensation falls under the Board of Individual Tax Preparers, created in 2008 by Business Occupations and Professions Article, Title 21. The Board's own manual sets the boundary crisply: licensed CPAs, JDs, enrolled agents, and local, state and federal employees performing duties within the scope of their employment, are exempt from the Board's regulatory authority — and so are their assistants, unless the assistant signs the return as preparer. Registration under §21-301 and §21-401 costs $100, runs two years, requires passing an examination at 70 percent or better, and requires sixteen hours of continuing education per renewal, of which four must be Maryland state tax subjects.

Then there is the electronic filing mandate. Tax-General §10-824(b) requires an income tax return preparer to file all qualified returns electronically if they prepared more than 100 qualified returns in the prior taxable year, with two escapes: §10-824(c)(1) if the taxpayer says on the return that they do not want it filed electronically, and §10-824(c)(2) a waiver from the Comptroller for reasonable cause or undue hardship. A hundred returns is a low bar. Almost any practice with a seasonal desk clears it.

The last subsection is the one nobody expects:

"If the Comptroller prohibits an income tax return preparer from submitting income tax returns electronically, the Comptroller shall notify the State Board of Individual Tax Preparers established under Title 21 of the Business Occupations and Professions Article within 5 business days after taking that action." — Md. Tax-General §10-824(e)

Maryland has wired its tax authority directly to its licensing board with a five-business-day statutory reporting duty. An e-filing suspension is not a technical inconvenience that stays inside the Comptroller's office; by operation of statute it becomes a licensing matter within a week. That is a materially different risk profile from most states, and it is worth knowing before you decide how casually to treat filing controls, preparer credentials on returns and who in the office is permitted to transmit.

A new pathway into the profession, effective October 1

The staffing picture is about to change too. House Bill 643, passed in the 2026 session and signed in April, adds a third route to CPA licensure in Maryland and takes effect on October 1, 2026 — under two months from the date on this article. Alongside the existing routes of a bachelor's degree with an accounting concentration plus thirty additional credit hours, or a master's in accounting, candidates can now qualify with a bachelor's degree, two years of relevant professional experience and the CPA exam. The 150-hour route continues unchanged.

For a firm's software that is not an abstraction. It means more early-career staff, earlier, supervised for longer, moving through your systems — and Section 314.4(c)(1)(ii) requires you to limit authorized users' access only to customer information that they need to perform their duties and functions. Least privilege is easy to write into a policy and hard to run when your March roster is double your September roster and half of it is new. If your platform's permission model is a flat list of roles, October is a good month to find that out.

What the vendor register looks like when you actually build it

The deliverable that resolves most of this is unglamorous and no one sells it: a register of every service provider that touches client data, joined to the engagements that data belongs to. For each vendor, what data it can reach, the contract and whether it contains the §314.4(f) and §14-3503(b)(1) clauses, the date of the last assessment and who performed it, the renewal date, and the notification path if that vendor is breached. For each engagement, whether your firm is the owner or the maintainer — and therefore whether the clock is 45 days or 10.

Firms build a version of this in a spreadsheet, and the spreadsheet is genuinely fine for about a year. It fails at renewal season, when nobody notices that the portal contract auto-renewed on the old terms, and it fails during an incident, when the one question you must answer in hours is which clients' data sat behind that one vendor and which of them are on the short clock.

Selling your services like products

Now the part of a modern accounting practice that has almost nothing to do with compliance and everything to do with cash — and where, in our experience, a small build pays for itself fastest.

The profession has spent a decade moving from hourly billing toward fixed-fee packages, and the fixed fees are largely still sold the way hourly work was: a conversation, a proposal, a letter, work performed, an invoice, and money somewhere between four and ten weeks later. Meanwhile the work itself has become genuinely productized. An individual return with a Schedule C is a defined package. Catch-up bookkeeping for six months is a defined package. An S-corp election and first-year filing is a defined package. Monthly bookkeeping at three transaction volumes is three defined packages. These are products. They are simply not sold like products.

What a storefront does is collapse the proposal, the engagement letter, the intake questionnaire and the payment into one flow that a client completes on a Sunday evening without speaking to anybody — and takes the money at the front. That is the whole idea, and it is why the Online Store package is the one we most often end up building for accounting firms rather than the bigger operations system.

The timing effect is the part firms underestimate. Say those 400 individual returns average $525, which is $210,000 of individual work. Billed on delivery, the bulk of it invoices between mid-March and April 15 and collects across April, May and June — a receivable that peaks precisely when the firm has just paid out its heaviest seasonal payroll. Sold prepaid from your own storefront, the same revenue lands as the engagement is accepted, most of it in January and February. Nothing about the work changed. About eight weeks came off the cash cycle, in the one season where eight weeks of working capital decides whether you can afford the fourth seasonal preparer.

Two smaller advantages are worth naming. The first is that it runs on your own merchant account, so the processing cost is the processor's published rate rather than a platform's markup, and the proposal itself carries no per-document fee. The second is compliance, and it is not incidental: a storefront you own is one fewer external system holding client identity documents, and the intake questionnaire can be built so that documents land straight in the systems you have already assessed instead of arriving as email attachments — which is the worst channel your firm has, and the one that §314.4(c)(3) has the most trouble with.

The honest limitation: a storefront sells packages with known scope. It will not price a messy multi-entity engagement with three years of unfiled returns, and it should not try. Roughly 60 to 75 percent of an established practice's individual work fits a defined package. The rest still needs the conversation. The goal is not to automate your judgment; it is to stop spending your judgment on the two-thirds of engagements that never needed it.

What custom actually costs

We fixed-price everything, so these are the actual numbers rather than a range that resolves into a change order later.

One line to add to any budget, because it is new and it catches people: Maryland now applies a 3 percent sales and use tax to information technology services, which reaches most of what you spend on software and on work like ours. It is a small number against the totals above, and it should be in the model rather than a surprise on the first invoice.

What we would actually build

Concretely, for a Baltimore firm of five to twenty people, in the order we would do it.

First, the storefront, because it pays for itself inside one season and it is the least disruptive thing on the list. Two or three packages to start — the W-2 return, the Schedule C return, and catch-up bookkeeping priced per month of backlog — with the engagement letter and the branched questionnaire attached to each, payment taken at acceptance, and the completed intake landing in the systems you already use. Nothing about your workflow changes. The money simply arrives before the work instead of after it.

Second, the register. Every service provider that can reach client data, with its contract, its clause status, its last assessment and its next one. Every engagement classified as owner or maintainer, so a folder knows which clock it is on. A quarterly assessment queue that produces a dated record when it is worked, because the requirement in §314.4(f)(3) is not "assess your vendors" — it is periodically assess them, and the evidence is the deliverable. This is a small piece of software. It is mostly a data model and a calendar, and it is the difference between answering a client's counsel in an afternoon and answering them in a fortnight.

Third, the seasonal capacity view your platform prices per seat but does not actually give you: returns by status by preparer against the calendar, with the ratio of extensions to filings tracked live, so that the decision to hire the fourth seasonal preparer is made in November on last season's real curve rather than in February on a feeling.

Fourth, if the firm has a mixed practice, the incident drill itself — a single screen that, given a compromised vendor, lists the clients whose data sat behind it, splits them into 45-day and 10-day obligations, and drafts the two notification paths. You hope never to use it. Building it is also the fastest way to discover that three of your engagements were never classified at all.

Build or buy

Our rule for this trade is narrower than usual, so here it is plainly.

• Buy the practice management platform. Job templates, capacity, client requests and the portal are solved problems, solved well, by firms with a decade of head start. Pay per seat and negotiate the meter, not the features.
• Buy the tax engine, always. Forms, calculations, e-file transmission and annual regulatory updates are not something any studio should quote you a fixed price to rebuild, and anyone who does should worry you.
• Build the storefront. Selling defined packages, prepaid, on your own merchant account is where the cash-cycle gain is, and it is the one place a small build changes the shape of your year.
• Build the register and the engagement model. The two-clock problem is Maryland-specific, engagement-shaped and unglamorous — which is exactly why no national product will ever ship it.
• Build the joins. Your platform knows the job, your tax software knows the return, your ledger access knows the client's books, and nothing on the market joins the three into the answer a partner actually wants.

Where to start

If you take one thing from this piece, make it the count. Sit down for twenty minutes and write out every company that can currently open a file holding a client's Social Security number or ITIN. Include the backup service. Include the phone system. Include the accountant-access logins you hold into clients' ledgers, because those run in both directions. Then, next to each one, write the date you last looked at their security posture, and leave the line blank where you have not.

That list is the honest starting position for both the federal rule and the Maryland statute, and it is also — not coincidentally — the best possible brief for a software conversation. It tells you which integrations are load-bearing, which subscriptions are duplicating each other, and which two or three of them are doing so little work that consolidating them is both a saving and a genuine reduction in the compliance surface you are required to maintain.

Then look at your January invoice and count the seats you are paying for in September.

Questions we get asked

How much does accounting practice management software cost in 2026?

More of this market publishes a price than most trades we have surveyed, which is a genuine credit to it. We checked twenty-six products on the practice side of an accounting firm's stack on August 4, 2026, and seven publish a price you can read straight off the page without speaking to anybody. Canopy lists Standard at $74 per user per month billed annually, Plus at $109 and Premium at $149, and states that monthly billing costs 20 percent more. Karbon lists Team at $59 per user per month paid annually or $79 paid monthly, and Business at $89 paid annually or $99 paid monthly. Jetpack Workflow lists Starter at $40 and Premium at $50 per user per month billed annually. Financial Cents starts at $19 per month billed annually on its Solo plan. Liscio lists $19, $49 and $99 per user per month billed annually. SmartVault lists Accounting Pro at $65 per user per month billed annually with a two-user minimum, or $85 billed monthly. Intuit publishes ProSeries figures outright: pay-per-return from $539 a year, Basic 1040 from $729 a year for twenty returns, and ProSeries Professional from $2,605 a year for unlimited 1040s. As a planning figure, a nine-person Baltimore firm running practice management, a document portal and professional tax software is realistically spending $16,000 to $22,000 a year before add-ons, and Maryland's 3 percent tax on information technology services now sits on top of the software portion.

Is my accounting firm covered by the FTC Safeguards Rule?

Yes, and the rule says so by name rather than by implication. The Safeguards Rule is codified at 16 CFR Part 314. Section 314.1(b) lists the kinds of business the Commission regulates and includes tax preparation firms in that list. Section 314.2(h)(2)(viii) then removes any remaining doubt with a worked example: an accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution because tax preparation services is a financial activity listed in 12 CFR 225.28(b)(6)(vi). There is no headcount floor, no revenue floor and no small-firm carve-out in that definition. A sole practitioner in Hampden preparing sixty returns from a spare room is inside it on exactly the same terms as a hundred-person firm on Pratt Street. The current version of the rule was published at 86 FR 70307 on December 9, 2021, its main compliance date was June 9, 2023, and the breach-notification provision at Section 314.4(j) took effect on May 13, 2024.

Does a small accounting firm get an exemption from the Safeguards Rule?

A partial one, and the shape of it is the single most useful thing to understand about the rule. Section 314.6 says that Section 314.4(b)(1), (d)(2), (h) and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers. That releases a small firm from four genuinely heavy obligations: the formal written risk assessment with documented evaluation criteria, the continuous monitoring or annual penetration testing plus semiannual vulnerability assessments, the written incident response plan, and the annual written report to the governing body. What Section 314.6 does not name is everything else. You still owe a written information security program under Section 314.3(a), a designated Qualified Individual under 314.4(a), access controls and least privilege under 314.4(c)(1), encryption in transit and at rest under 314.4(c)(3), multi-factor authentication under 314.4(c)(5), secure disposal no later than two years after last use under 314.4(c)(6)(i), staff training under 314.4(e), and notification to the FTC within 30 days when a breach touches 500 consumers under 314.4(j). And you still owe the whole of Section 314.4(f), the service provider clause. That is the one obligation in the rule you cannot shrink your way out of.

What does the Safeguards Rule require me to do about my software vendors?

Three separate things, and most firms have only done the first by accident. Section 314.4(f) requires you to take reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards, to require your service providers by contract to implement and maintain such safeguards, and to periodically assess your service providers based on the risk they present and the continued adequacy of their safeguards. Section 314.2(r) defines a service provider broadly: any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a financial institution. That is not a short list for a modern practice. Tax software, practice management, the document portal, the e-signature and identity verification provider, cloud hosting, backup, the outsourced IT firm, the payroll platform, the bookkeeping ledger, the payment processor, email and the phone system that transcribes voicemail are all inside the definition when they touch client data. Each one needs a contract with a security clause and a periodic, risk-weighted assessment on a schedule you can evidence. The compliance work scales with the number of vendors you run, which is the strongest argument the consolidated platforms have, and one they rarely make.

What are Maryland's data security and breach notification rules for accountants?

Maryland asked for the same vendor clause fourteen years before the FTC did, and it attaches two different clocks to a breach. Commercial Law Section 14-3503(a) requires a business that owns, maintains or licenses personal information of a Maryland resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information and the nature and size of the business and its operations. Section 14-3503(b)(1) then requires that where you disclose that information to a nonaffiliated third party service provider under a written contract, you shall require by contract that the third party implement and maintain reasonable security procedures and practices, and Section 14-3503(b)(2) applies that to every written contract entered into on or after January 1, 2009. The definition matters as much as the duty: Section 14-3501(e)(1)(i)1 lists a Social Security number, an Individual Taxpayer Identification Number, a passport number, or other identification number issued by the federal government among the data elements that make information personal. An ITIN is named in the statute, which puts a large share of Baltimore's immigrant-serving tax practices squarely inside it. On breach, Section 14-3504(b)(3) gives you 45 days from discovery to notify the individual. But Section 14-3504(c)(2) gives you only 10 days to notify the owner where you merely maintain computerized data that you do not own or license — which is exactly the posture of any firm doing outsourced bookkeeping or controller work.

Why is per-user pricing a bad fit for a seasonal tax practice?

Because a per-seat meter charges for headcount and a tax practice does not have a headcount, it has a hydrograph. Model a nine-person Baltimore firm: five people year-round, four seasonal preparers and reviewers working fourteen weeks from mid-January to April 15. Annual billing prices your peak, so you buy nine seats for twelve months, which is 108 seat-months. The work consumes about 72.9. The 35.1 seat-month difference is 32.5 percent of everything you pay. On Canopy Standard at $74 that is $2,596 of empty seats in a year, and adding SmartVault Accounting Pro at $65 takes the pair to $4,876. The obvious escape is monthly billing, which lets you drop seats in May. It recovers only about 42 percent of the loss, because flexibility is priced: Canopy's own page states that annual billing saves 20 percent, so a flexed seat costs $92.50 instead of $74, and SmartVault publishes $85 monthly against $65 annually. Nine annual seats on both products cost $15,012; the same work billed monthly and flexed costs about $12,944; the theoretically fair figure at the annual rate for the months actually used is $10,136. Commit and you overpay by $4,876. Flex and you overpay by $2,808. The meter is built so a seasonal firm loses either way, which is not malice — it is a meter designed for a business with a stable roster.

How many accounting firms are there in Baltimore and Maryland?

We counted from the Census Bureau's 2023 County Business Patterns county file rather than repeating a trade association figure. Across the four accounting NAICS codes — 541211 offices of CPAs, 541213 tax preparation services, 541214 payroll services and 541219 other accounting services — Maryland has 2,447 establishments with paid employees, 19,224 employees and about $1.571 billion in annual payroll. Montgomery County leads with 625 establishments, then Baltimore County with 451, Prince George's with 234, Anne Arundel with 194, Howard with 168, Baltimore City with 145, Frederick with 119, Harford with 106 and Carroll with 73. The interesting number is size, not count. Baltimore City has the sixth-largest establishment count in the state and the third-largest employment, because its 55 CPA offices average 34.1 people each against Anne Arundel's 5.7 and Carroll's 4.4. Payroll follows: the city pays $120,914 per CPA-office employee against Carroll's $54,308. That is a barbell market — a downtown cluster of large regional and national offices, and a long tail of two-to-six person practices spread through the counties — and the two halves want completely different software. One caveat worth stating: County Business Patterns counts only establishments with paid employees, so the many one-person practices that run with no payroll never appear in this file at all.

Is it worth building custom software for an accounting or tax firm?

Not to replace your practice management platform, and not to replace your tax software. Canopy, Karbon, TaxDome, Jetpack Workflow, Financial Cents and Liscio solve real problems — job templates, capacity views, client requests that chase themselves, a portal your clients will actually log into — and a firm that is happy with its platform should stay on it. Rebuilding a professional tax engine is not a project any sensible studio would quote. The case for a build is narrower and much better defined. The first piece is the storefront: your fixed-fee packages sold and paid for online, on your own merchant account, with the engagement letter, the intake questionnaire and the payment in one flow, so the cash arrives before the work does instead of eight weeks after it. The second is the register nobody sells — a living inventory of every vendor that touches client data, with the contract clause, the last assessment date and the two Maryland notification clocks attached to each engagement, so that a firm that is both a covered financial institution and somebody else's service provider can answer the question in an afternoon rather than a fortnight. Our Prototype Sprint is $3,500 and is usually the right first step. Online stores start at $6,000 and full operations systems at $12,000.