Technology That Disappears.Billable Time That Doesn't.
VanderNet helps CPA, tax, and accounting firms protect client data, maintain staff capacity, and keep technology from becoming a deadline problem. Whether your firm bills by the hour or delivers fixed-fee services, avoidable disruptions cost more than time. Every update is reviewed before it reaches you. Every critical issue has someone on it until it's resolved. You serve your clients. We handle the technology.
Free. No obligation. It's a conversation.
Average resolution time is measured across helpdesk tickets for managed clients. Client retention is calculated across active managed service agreements. Engineer experience reflects years in IT and cybersecurity roles across the VanderNet team.
Serving CPA firms across Missouri · Arkansas · Kansas · Oklahoma and the Midwest.
The Real Cost
Every Hour Down Is an Hour You Can't Bill.
You didn't build a firm to manage servers. But when systems fail during audit season, deadlines don't move, and clients still expect answers.
Somewhere along the way, you became your firm's unofficial IT department — chasing callbacks, wondering whether last night's update will break this morning's returns, and hoping nothing goes down before the deadline.
You shouldn't have to wonder whether anyone is on it. You need an IT partner who does the worrying, so you never have to.
Whether your firm bills by the hour or serves clients on a fixed-fee basis, the cost of a technology failure is the same: capacity lost, deadlines pressured, and a team that should be focused on client work spending time on a problem that should have been someone else's to solve.
Why We Do It Differently
Two Stories. One Standard.
Story 01
An Update. Two Days. Two Crashes.
A multi-site CPA firm depended on its infrastructure being available, and it was audit season. Their IT company released an update that crashed their server two days in a row, costing the firm significant billable hours. As they were coming onboard with us, we looked into what happened and found we had already blocked that same update for our clients.
How We Prevent It
We hold general updates for 30 days, giving vendors time to pull or fix updates that don't work before they reach your firm. Security-urgent patches are the exception. See our full update policy in the FAQ below.
Due diligence happens before the update, not after the apology.
Story 02
“Call Me Back in 10 Minutes.”
A firm's server went down. It was a critical problem. They called their IT company. The engineer said he'd look into it, and the firm asked him to call back in 10 minutes. Twenty minutes went by, then more. No call. The firm had to call back themselves, only to be told the engineer had gone to lunch.
How We're Different
At VanderNet, that doesn't happen. We stay on until the issue is resolved, and someone is always available for critical issues.
If our client isn't eating lunch, we're not eating lunch. Critical issues stay owned. Your firm receives clear updates, an agreed next step, and a coordinated handoff whenever another team member takes over.
Both stories are real. Details are anonymized to protect client confidentiality.
"Every firm we serve gets the same commitment I make in person: we do our homework, we own what we handle, and we're here every step of the way."
— Garrett Vanderpool
CEO, VanderNet
If this is the standard you expect from your IT partner, let's talk.
Free. No obligation.
Who We Serve
Two Roles. One Standard of Support.
For Owners and Managing Partners
Protect the capacity and confidence your firm depends on.
Whether your firm bills by the hour or delivers services for a fixed fee, avoidable technology interruptions consume staff capacity and put pressure on margins. A server outage during tax season doesn't just cost billable hours — it costs client confidence, staff focus, and your own time. VanderNet helps you connect technology decisions to the firm's actual priorities. You get a clearer basis for decisions about security gaps, spending, staffing changes, and growth — without needing to become your own IT department to make them.
What that looks like in practice:
- A plain-English summary of your firm's security posture and open risks
- A technology plan built around your firm calendar, not ours
- Advance notice before anything significant changes, with your approval required
- Regular check-ins that connect technology priorities to what the firm is doing next
For Practice Managers and Operations Leaders
You already run the practice. Technology should be easier to coordinate.
A new employee needs access before their first day. A tax application stops working during month-end close. A departing team member's permissions need to be removed before end of day. You need to know who owns the next step — and you need it handled without becoming a project you manage yourself. VanderNet gives you a defined process for the technology work that lands on your desk.
| Situation | How VanderNet Handles It |
|---|---|
| Hiring seasonal or new staff | Equipment readiness, account setup, and approved access before their first day. |
| A staff member departs | Coordinated removal of account, device, and client-file access. |
| Multiple vendors are involved | We communicate with your vendors and bring you a status update — you don't sit on hold. |
| Month-end close or payroll is approaching | Critical periods are logged in advance; escalation is faster and changes are held. |
| A team member wants to use an AI tool | We help evaluate the tool, what data it can access, and what the firm needs to put in writing. |
Hiring seasonal or new staff
Equipment readiness, account setup, and approved access before their first day.
A staff member departs
Coordinated removal of account, device, and client-file access.
Multiple vendors are involved
We communicate with your vendors and bring you a status update — you don't sit on hold.
Month-end close or payroll is approaching
Critical periods are logged in advance; escalation is faster and changes are held.
A team member wants to use an AI tool
We help evaluate the tool, what data it can access, and what the firm needs to put in writing.
Built for Your Calendar
Busy Season, Planned.
Your year isn't flat, and your IT shouldn't act like it is. Here's how we work around the calendar that runs your firm.
Before the Rush
We learn your firm, your software, and your deadlines before we change anything.
We learn your calendar before we touch it.
During the Season
General updates are held and security-urgent patches are fast-tracked.
A bad update shouldn't crash your server mid-return.
Deadline Week
We stay on until the issue is resolved, and someone is always available for critical issues.
No "call you back in 10 minutes."
After the Deadline
Provider switches, technology changes, and new offices are planned around your deadlines. Nothing changes until you approve it.
Your calendar sets the schedule, not ours.
The VanderNet Promise
Due Diligence. Before the Deadline.
Three commitments we make to every firm we serve.
We Do Our Homework.
We learn your firm, your software, and your deadlines before we touch anything.
We Own It.
Your issue doesn't get passed around, forgotten, or put on hold. You get a real person, a clear answer, and a follow-up when we said we'd follow up.
We're Here Every Step of the Way.
From your first strategy session to busy season to your annual technology plan, you're never figuring it out alone.
What We Handle
Your Technology, Handled.
One partner for the systems, security, and vendors behind your practice.
Managed IT & Helpdesk
Fast support from people who know your firm. Real answers, a real follow-up, and a callback when we say we'll call.
Security & Monitoring
Monitoring, endpoint protection, and email security that guard the client financial data you're trusted with.
Compliance Alignment
Technical safeguards mapped to the FTC Safeguards Rule and GLBA, with support for your Written Information Security Plan (WISP) — including identifying gaps, maintaining evidence, and keeping the plan current as your firm changes.
Backup & Continuity
Tested backups and a recovery plan, so a failure during deadline week is an inconvenience, not a crisis.
Vendor Management
We work with your software and internet vendors so you don't spend your day on hold.
AI Readiness
Practical guidance on using AI tools safely with client data: what to allow, what to block, and how to start.
Growth Enablement
Technology planning that supports new staff, new offices, and new clients without the growing pains.
Software We Support
Frameworks We Align To
VanderNet supports your firm's compliance program. It does not replace legal or compliance advice.
Written Information Security Plan
What WISP Support Actually Includes.
The IRS requires tax preparation firms to maintain a Written Information Security Plan — not just have one. That means the plan must be kept current, tested regularly, and updated when your firm's technology, staff, or operations change.
VanderNet's WISP support goes beyond producing the document:
- Review the technical components of your existing or new WISP against current FTC requirements and IRS guidance
- Identify gaps between what the plan says and what your systems actually do
- Assign and track actions so open items have owners and timelines
- Maintain evidence that safeguards are operating — access logs, configuration records, training records, and review history
- Update the plan when you add staff, change applications, onboard new vendors, or move to a new office
The IRS's Publication 5708 provides the framework. VanderNet helps you operate it.
VanderNet supports your firm's compliance program. It does not replace legal or compliance advice.
Professional Obligations
Circular 230 and Your Professional Obligations.
Circular 230 governs how tax practitioners represent clients before the IRS. Three of its provisions connect directly to how your firm handles technology and client data.
Requires practitioners to maintain competence — and the IRS has explicitly connected that standard to technology and data security.
Places responsibility on firm owners and managers to ensure adequate procedures exist for Circular 230 compliance.
Sets out aspirational best practices that include maintaining client confidences.
Sound security practices support your professional responsibilities as a practitioner. VanderNet's recommended approach maps the technical controls behind your WISP to these obligations, so your security program supports both the FTC's requirements and your responsibilities under Circular 230.
VanderNet supports your firm's compliance program. It does not replace legal or compliance advice.
How It Works
Four Steps. No Surprises.
Getting started is simple, and nothing changes until you say so.
- 1
Book a 15-Minute Strategy Session.
A short conversation about your firm, your software, and what's slowing you down. No pressure, no jargon.
- 2
We Review Your Environment.
We look at your systems, security, backups, and software, and explain what we find in plain English.
- 3
We Build Your Plan.
You get clear priorities and a timeline that works around your deadlines, not during them. Nothing starts until you approve it.
- 4
We Take It From Here.
We handle the onboarding and stay with you through busy season and beyond.
Step one takes 15 minutes.
Not ready to book yet?
Take our 60-second Business Security Risk Scorecard and see where your firm stands.
Free. Takes about a minute.
Common Questions
Straight Answers.
Don't see yours? Ask it in your strategy session.
How much does it cost?
Pricing depends on the number of users and locations in your firm and the support you need. We'll walk through it with you in plain terms during your strategy session.
What is included in the environment review, and what does it cost?
The 15-minute strategy session is always free — it's a conversation about your firm, your software, and what's slowing you down. If it makes sense to move forward, we conduct an environment review: we look at your systems, security posture, backups, and software, and explain what we find in plain English. The scope of that review and any associated costs are agreed before we begin — we don't start work you haven't approved. From there, we build a plan with clear priorities and a timeline. Nothing starts until you approve it.
Can we switch IT providers during busy season?
Yes, and we plan the transition around your deadlines. Nothing changes until you approve it.
What does busy-season support actually look like?
We learn your software and your deadlines before we change anything, manage updates through an assessed and structured process, and plan any change around your calendar. Nothing changes until you approve it, and someone is always available for critical issues until they're resolved. For the full detail on how updates are handled, see 'How does VanderNet manage updates and patches?' below.
What happens to our current IT person or provider?
We can work alongside your existing IT person or team, or take over completely. Either way, we plan the handoff so your firm isn't left in the middle.
Do you work with the tax software we use?
We support Thomson Reuters, DrakeTax, and other modern tax and accounting platforms. If you use something else, ask us during your strategy session.
Does our firm really need to worry about the FTC Safeguards Rule?
Most likely, yes. The FTC treats tax preparers as financial institutions under the Safeguards Rule, which requires a written information security program. We align your technical safeguards to it and support your Written Information Security Plan (WISP). VanderNet supports your compliance program; it does not replace legal or compliance advice.
How does VanderNet manage updates and patches?
For updates we manage, we assess urgency, review potential impact, test where practical, and schedule deployment around your critical work periods. General updates are held for 30 days — that window gives Microsoft and other vendors time to identify and withdraw updates that cause problems. Security-urgent patches follow an accelerated process and are not held. Where a software vendor controls its own release schedule, we help you assess the impact and coordinate the response. Nothing changes without your awareness, and critical periods are logged in advance so updates are not deployed at the wrong time.
Where do you work?
We serve CPA and accounting firms across Missouri, Arkansas, Kansas, Oklahoma, and the Midwest.
Does the FTC Safeguards Rule apply if we're a small firm?
Almost certainly yes. The rule includes a limited exception for firms maintaining information on fewer than 5,000 consumers, but that exception only removes certain written documentation requirements. It does not exempt any firm from maintaining a written information security program, implementing core safeguards, conducting risk assessments, or testing that safeguards are working. If your firm prepares tax returns, the FTC treats you as a financial institution and the Safeguards Rule applies. VanderNet supports your program regardless of firm size. This is not legal advice — your counsel can confirm your firm's specific obligations.
How are seasonal employees onboarded and their access removed?
Before a seasonal hire starts, we coordinate equipment setup, account creation, and access limited to what they actually need. When the engagement ends, we work with you to remove or suspend that access promptly — devices, applications, email, and client file access. Access that lingers after someone leaves is one of the most common security gaps in accounting firms. We help you close it on schedule.
What happens when our issue involves multiple vendors?
When a problem involves your tax software, your internet provider, your hardware, and us simultaneously, you get one point of contact at VanderNet. We coordinate with the other vendors, track the status, and give you plain-English updates until it's resolved. You shouldn't spend your day on hold with four different help desks.
What does "testing your safeguards" mean in practice?
The FTC requires that your information security program be tested or monitored for effectiveness. For your firm, that includes confirming that access controls work as intended, that backups restore successfully, that monitoring is catching what it should, and that your team knows what to do if something goes wrong. VanderNet documents the results and flags anything that needs attention.
Can I see case studies or talk to your clients?
We don't publish client names — protecting confidentiality is part of the job, and that's also why the stories on this page are anonymized. If you'd like to speak with a client, we can discuss that at an appropriate stage with their permission. In the meantime, we can walk you through what a typical engagement looks like and what evidence you would receive. You can also read anonymized examples on our case studies page.
Your Next Step
Technology Should Disappear. Your Business Should Thrive.
We protect your billable time so you can serve your clients.
Start with a 15-minute conversation.
Free. No obligation. It's a conversation.
Serving CPA and accounting firms across Missouri, Arkansas, Kansas, Oklahoma, and the Midwest.