Client document intake and organization
Route portal uploads, emails, and prior-year files into a client-specific evidence map before a preparer starts sorting.
CPA
§7216-sensitive practices
ENTRY CPA-0001Get through busy season with AI capacity — client data stays under your firm's control.
Cartulary gives CPA teams a private control layer for client intake, workpaper prep, and CAS responses. Your firm's permissions, review gates, and audit trail sit between staff workflows and every model request.
Workpaper prep and tie-outs with review gates
Draft workpaper notes and tie-out suggestions only after source fields are linked, masked where needed, and queued for reviewer sign-off.
Client query responses in CAS
Prepare response drafts from approved client context, then require a human release step before anything leaves the firm.
02
Busy-season workflow walkthrough
REVIEW QUEUEStart with one packet-heavy workflow: document intake through a reviewed workpaper note. The control layer records who used which source, what was masked, and where reviewer judgment entered.
- Client packet lands. W-2s, K-1s, bank exports, and prior-year workpapers are assigned to the client record.
- Policy checks run first. Sensitive fields are masked or blocked according to the firm's written AI use policy.
- Preparers get a draft map. The system suggests document categories, missing items, and tie-out candidates with source links.
- Reviewer gate stays mandatory. A senior reviewer approves, edits, or denies each suggested workpaper note before use.
- Every step is reversible. A partner can revoke a response draft, restore the prior note, and keep the reason on the record.
03
Control layer proof
PERMISSIONS + AUDIT LOGPermission checks before model use
| Role | Allowed | Gate |
|---|---|---|
| Staff preparer | Classify source docs; view masked fields | Masked |
| Senior reviewer | Approve tie-out notes and source links | Review |
| Partner admin | Set policy, release client responses, reverse drafts | Approved |
Client tax ID · policy CPA-7216-04 · reviewer gate required
Audit-log mock
| Entry | Timestamp | User | Action | Model | Status |
|---|---|---|---|---|---|
| CPA-0042 | 2026-01-14 08:32:10 | staff.prep | Classified 38 client uploads for workpaper prep | model-router | Review |
| CPA-0043 | 2026-01-14 09:05:44 | senior.review | Approved tie-out suggestion after source match | model-router | Approved |
| CPA-0044 | 2026-01-14 09:18:03 | partner.admin | Denied CAS response draft before client delivery | model-router | Denied |
who asked · what data · which model · reviewer decision · when
Compliance language
Designed for §7216-sensitive practices; client data use under your firm's written policies.
Cartulary is designed to support CPA teams that need policy control before client data is used in AI workflows. Reviewer sign-off gates stay in the path, and drafts can be reversed before client delivery.
Operating record
Policies matter because they can be enforced.
Each workflow ties approved use, denied use, masked fields, and reviewer decisions back to a record your firm can inspect when a client, partner, or regulator asks what happened.
04
Founder-led credibility note
NO BLACK BOXCartulary is founder-led and built for firms where a partner remains accountable for client work. The product bias is control first: narrow workflows, written policies, reviewer judgment, and a durable record of every AI-assisted action.
05
Scope the first busy-season workflow.
20 MINUTESBring one intake, workpaper, or CAS response workflow. Leave with the control points that need to exist before staff use AI on client work.
06
The CPA Firm AI Use Policy Template
POLICY TEMPLATEA practical fallback for firms still setting internal rules: permitted uses, restricted data, review duties, vendor questions, and a partner sign-off page.
Template offer · cpa-firm-ai-use-policy-template · form posts to /api/lead
07
CPA firm objections
FAQWhat does this cost?
The working session scopes a narrow workflow and the control requirements before a proposal. The business case should tie to seasonal overtime, rework, partner review time, and risk reduction.
Is there enough time before busy season?
Yes, if the first rollout is narrow. Start with document intake, workpaper tie-outs, or CAS response drafts rather than a firm-wide transformation.
Will client data train vendor models?
The control layer is designed around firm-owned policy, model routing, masking, and audit logs. Where contractually supported, client data is not retained for vendor training.
Does this replace preparers or reviewers?
No. It gives staff draft structure and source-linked suggestions while keeping reviewer sign-off, partner release, and reversibility in the workflow.