Security Addendum

This security overview explains how Q3 Advisors protects the financial documents and personal data you share through our secure file uploads and Data Gathering Portal, so you can confirm your information is safeguarded before uploading.

Last reviewed: August 2026 | Written and reviewed by Craig Wear, CFP®, founder of Q3 Advisors

What this security overview covers

This security overview covers how Q3 Advisors, a registered investment adviser focused on retirement tax planning, protects information across two systems: secure file sharing and the Data Gathering Portal. It explains encryption in transit and at rest, who can access your data, how uploads work, activity monitoring, regulatory compliance framing, and how long records are retained.

How is my data encrypted?

Q3 Advisors uses two layers of encryption. Data moving between your browser and our applications is encrypted in transit using TLS/SSL. Files and portal data at rest sit in secure Google cloud storage, where AES-256 encryption is applied by default.

In transit (TLS/SSL)

Data in transit is information moving between your device and Q3 Advisors’ web applications. Q3 uses TLS/SSL to encrypt these connections, the same protocol shown by your browser padlock, which helps prevent interception while data travels. This protection applies whenever you sign in, upload a document, or submit details through the Data Gathering Portal during a session.

At rest (secure cloud storage / AES-256)

Data at rest is information stored after you submit it. Q3 Advisors keeps files and portal data in secure Google cloud storage, where AES-256 encryption is applied by default. Access to that stored data is further limited through application permissions.

Who can access my information?

Access to your information at Q3 Advisors is limited to authorized team members and approved systems needed to deliver services or meet legal obligations. Access is controlled through account setup, invite-based access, and verification tied to your request. Least-privilege permissions further restrict what each person or system can reach, so exposure to sensitive client data stays minimal.

Access controls and least-privilege permissions

Least-privilege permissions mean each user or system gets only the access a task requires, and no more. At Q3 Advisors, client information is restricted to authorized personnel and approved systems through application permissions that limit exposure to sensitive data. This narrows how many people and services can view any given file and reduces the impact if one account is ever compromised.

Authentication, invite-based access, and one-time verification

Authentication confirms who is accessing a workflow before information is shared. Access to the Data Gathering Portal and related secure workflows runs through account setup, invite-based access, and verification. You may complete a one-time verification step before finalizing an upload.

How do secure file uploads work?

Secure file uploads at Q3 Advisors use a request-specific link rather than email attachments, which can be intercepted or forwarded. When we ask for documents, we send a secure upload link tied to one request. The link is time-limited, access is controlled, and upload activity is logged for a clear record.

1. Q3 Advisors sends you a request-specific upload link tied to the documents being requested.
2. You confirm the link is expected and, if unsure, verify it with a known Q3 Advisors contact.
3. You complete any one-time verification step before finalizing the upload.
4. You upload your documents through the encrypted connection before the link expires.
5. Q3 Advisors logs the upload activity, and the submission can be locked once received.

Time-limited, request-specific upload links

A request-specific upload link is created for a defined purpose and expires after a set window. This limits how long a link stays usable and ties it to a known request. Verify any unexpected link with a known Q3 Advisors contact first.

Locked submissions and logged activity

Once a file upload request is formally submitted, it can be locked, so further changes require a new request. Upload actions and workflow events are logged. Locking submissions and logging activity preserve a clear record of client document handling. These records help Q3 Advisors track who submitted what and when, and support the recordkeeping standards that apply to registered investment advisers.

How is the Data Gathering Portal protected?

The Data Gathering Portal lets you provide financial and planning information online, such as income, assets, liabilities, and documents. Portal access runs through account setup, invite-based access, and verification. Submitted information sits in secure application systems on encrypted cloud storage, reachable only by authorized personnel.

Many clients use the portal while preparing a Roth conversion analysis or reviewing required minimum distributions for 2026, where accurate data matters.

How does Q3 Advisors monitor and log activity?

Q3 Advisors maintains activity records for portal and file-related actions to support operations and security oversight. Logged events may include upload activity and other workflow actions tied to client document handling, governed through internal permissions that limit exposure. Keeping these logs helps Q3 detect unusual activity, respond to questions about how a document was handled, and preserve an audit trail consistent with its compliance obligations.

What third-party providers does Q3 use?

Q3 Advisors uses vetted third-party providers to support secure operations, communications, and document workflows. The main provider for secure file storage and application functionality is Google cloud services. Q3 may also use other approved providers for communications and business operations.

How we work with Google cloud services

Q3 Advisors uses Google cloud infrastructure for secure file storage. Certain approved-form internal document workflows may use Google Drive or Google Workspace. These services operate inside Q3’s access-control framework, limiting access to authorized users and approved business processes. Google applies AES-256 encryption to stored data by default, and Q3 layers its own permissions on top so that only staff with a business need can reach client files.

How does Q3 stay compliant?

Q3 Advisors handles client data with reference to standards for advisory and brokerage firms. The central standard is SEC Regulation S-P, governing how nonpublic personal information is protected. FINRA Rule 4511 and SEC Rule 17a-4 shape how firms preserve records.

How long is my data retained, and can I request deletion?

Q3 Advisors retains client information under business, legal, and regulatory requirements. You may request deletion, and requests are reviewed against those obligations. Because recordkeeping rules can require preserving certain records, some information may be retained even after a request. Rules such as FINRA Rule 4511 and SEC Rule 17a-4 set minimum retention periods, so Q3 balances any deletion request against the records it is required to keep.

How do I report a security concern or suspicious message?

To report a potential security vulnerability related to Q3 Advisors, email assistance@q3adv.com. For privacy questions or suspicious messages, contact cw@craigwear.com or your known Q3 Advisors contact to verify. Confirm any unexpected upload link before a year-end Roth conversion deadline. If a message asks you to upload documents or share login details and seems out of place, verify it through a channel you already trust before you act.

Frequently asked questions

What is a security overview?

A security overview is a plain-language document explaining how an organization protects your data, files, and accounts. It typically describes encryption, access controls, monitoring, retention, and compliance. For Q3 Advisors, it shows how your documents and portal data are protected before you upload.

How do financial advisors keep client data secure?

Financial advisors keep client data secure using encryption in transit and at rest, least-privilege access controls, strong authentication, and activity logging. Registered investment advisers also follow SEC Regulation S-P and recordkeeping standards such as FINRA Rule 4511 and SEC Rule 17a-4.

Is a client portal safe for sending financial documents?

A reputable client portal is safer than email for financial documents because it uses encrypted connections, controlled access, and audit logging. The Q3 Advisors Data Gathering Portal uses invite-based access, one-time verification, and secure cloud storage, limiting access to authorized personnel.

What encryption do secure client portals use?

Secure client portals typically use TLS/SSL to encrypt data in transit between your browser and the server, and AES-256 encryption to protect data at rest. Q3 Advisors relies on Google cloud infrastructure, where these standards apply to stored data by default.

How do I securely send documents to my financial advisor?

To securely send documents to your financial advisor, use a request-specific upload link or client portal instead of email attachments. With Q3 Advisors, the process typically works like this:

1. Wait for a time-limited upload link tied to a specific request.
2. Confirm the sender is a known Q3 Advisors contact before you click.
3. Complete any one-time verification step.
4. Upload your documents through the encrypted connection before the link expires.

What is SEC Regulation S-P?

SEC Regulation S-P is the rule governing how registered investment advisers and broker-dealers protect nonpublic personal information. Amendments adopted in 2024 add incident-response and customer breach-notification duties, with phased compliance dates including June 3, 2026.