Practice Protect

This is not a practice management system, and a firm shopping for one should not put it on the same shortlist as Karbon or Canopy. Practice Protect is cybersecurity and identity management built for accounting and bookkeeping firms, and it sits alongside whatever practice management the firm already runs rather than replacing any part of it. The core is access management: one login that fronts more than 6,000 cloud applications, with the underlying credentials masked so staff never see or share a password, real-time visibility of who is signed in from which device and location, and offboarding that pulls a departing preparer out of every application in one action. Around that sit email security that blocks phishing, spoofed domains and malicious attachments before delivery, device security with managed antivirus, patching, Windows updates and remote wipe, monthly security awareness training, and a compliance module with prebuilt policy templates for privacy, breach response, AI usage, IT and internet use, and data retention. The vendor says 28,000 accounting professionals use it and that it has been running more than ten years.

The reason a US firm searches for this is the FTC Safeguards Rule, which has applied to tax preparers as financial institutions since June 2023 and requires a written information security program, access controls, MFA, staff training and an incident response plan. Practice Protect maps onto most of that in one purchase, and the vendor's own case study of JB Advisory Group, a nine-person firm in Lafayette, Colorado, states the firm became compliant with the FTC Safeguards Rule and IRS Publication 4557 after implementing it. Other named US customers are small: a four-person tax practice, a fourteen-person firm in Denver, an Atlanta consultancy. That is the right size band for this directory.

Two things complicate the buy. The first is that the product no longer presents itself to US buyers directly. The pricing page at practiceprotect.com now redirects to the Rightworks Cloud Protect page, the site's guides, blog and regulatory map deal exclusively with Australian rules such as the TPB Code, the Privacy Act and AML/CTF Tranche 2, the footer entity is Practice Protect Australia Pty Ltd, and the listed US office at 300 Innovative Way, Nashua, New Hampshire is the same address as Rightworks' headquarters. A US firm should expect to be quoted Rightworks Cloud Protect, whose page names QuickBooks Online, Xero, ADP, Canopy, TaxDome, Intuit Tax Online, Dext, Bill.com and Expensify among the applications behind the single login. The second is that no price is published on either side of that redirect, and a security subscription that also carries managed device services is not a small line item for a ten-person firm.

There is no like-for-like alternative in this category, because the alternatives are the practice management systems it complements. Karbon, Canopy, TaxDome and CCH Axcess Practice each bring their own portal, permissions and audit trail, which narrows what Practice Protect has to cover but never removes the email, device and staff training problem. The genuine substitutes are a general MSP running a Microsoft 365 security stack, or Rightworks' own bundles.

The tier moves from top-pick to strong-option, on two grounds. It cannot be the place a firm starts in practice management, because it is not practice management. And the US route to buying it now runs through a different brand while practiceprotect.com markets to Australia, which is a material thing for an American buyer to know before booking a demo. What could not be confirmed from vendor sources is the date or the terms of the Rightworks relationship.