How we protect your information.

The short version

We collect as little as possible, we never sell anything, and we work hard not to keep your Social Security number. The devices that hold your information are encrypted.

We'd rather not hold your data at all

The strongest protection isn't a security control — it's not having the information in the first place. Data we never collected can't be breached, can't be leaked, and never needs a notification letter.

In practice that means we ask for the minimum needed to do the work. Some of it we do need: to help with filings, carrier verifications, or a business account, we often need your EIN and your IRS confirmation letter (the CP 575 or 147C), because the legal name has to match the IRS record exactly. We keep those, securely, for as long as the engagement requires.

What we work hard not to hold is your Social Security number. Where an application requires it — an EIN application, for instance — we would rather sit with you and have you enter it yourself than take it and store it. If a document you send us contains one, we use it for the task at hand and destroy our copy.

What we do collect

Your name, email, phone number, and the details about your business that you give us so we can do the work — formation documents, filings, correspondence, your EIN and IRS confirmation letter, and where a filing requires it, a home address. Nothing beyond what the work needs.

The standards we hold ourselves to

These are the requirements in our written information security policy, which we provide to clients, funders, and partners on request.

• Encryption. Full-disk encryption on every device that holds your information. Everything sent to and from this site travels over TLS — that part you can verify yourself in your browser.
• Multi-factor authentication on every account that touches your information.
• Secure destruction. Paper is cross-cut shredded. Electronic media is erased so it can't be reconstructed — including before any device is sold, donated, or thrown away.
• Least access. Information is available only to whoever needs it for the work, for as long as the work takes.

Your accounts stay yours

When we help you set up a service — your registered agent, your payment processor, your business email — the account is registered in your name and you own it. We take administrative access only, so we can do the work, and we hand it back when the engagement ends or whenever you ask. We never put your business's payment processing or customer messaging in StartedBlack's name.

We don't sell your information

Not to advertisers, not to data brokers, not to anyone. We share information with the service providers that help us operate — our email, hosting, and payment tools — and only as much as they need. And, when you give us permission, with an attorney or accountant if your situation needs one. Our bank and accountant see what they need for us to operate, and we would disclose information if the law required it — we'd tell you unless we were legally barred from doing so.

We are not yet set up to take card payments. When we are, card details will go directly to the payment processor and we will never see or store a full card number.

How long we keep things

Signed agreements and financial records for seven years, because tax and limitations periods require it. Intake forms for three years. Your EIN letter and formation documents for as long as the engagement requires, then returned or destroyed. Documents containing a Social Security number are destroyed as soon as they've served their purpose — we keep one only if you ask us in writing to. You can ask us to delete what we hold about you at any time.

Questions

Email c.williams@startedblack.org. If you think something is wrong with your data or our handling of it, say so plainly and we'll deal with it.

Last updated: August 12, 2026. See also our privacy policy.