📋
What Type of Request?
Select the category that best describes your request
🔌
Add-in to Existing Program
Plugin, extension, or add-on for software we already use
👤
Tool for Personal Use
Individual productivity tool or utility for your role
👥
Application for Department/Group
New application for a team, department, or company-wide
🔄
Replacement of Existing Application
Replace a current tool with a new solution
📤
File-Transfer Tool Exception Request
Request a limited exception to use a third-party file transfer platform — only where mandated by a government agency, regulatory body, court, taxing authority, or approved audit process. Not available for client preference or convenience.
📋 PLEASE READ BEFORE CONTINUING — File-Transfer Platform Exception Policy
SAX permits exceptions for the use of third-party platforms only in limited circumstances where the external platform is required by a government agency, regulatory body, court, taxing authority, state or municipal agency, or an approved business-to-business audit or examination process.
Exceptions are intended only for situations where SAX does not control the required platform and cannot reasonably use HubSync, Suralink, OneDrive, SharePoint, or another approved SAX system as an alternative.
Client preference, convenience, familiarity with another platform, or unwillingness to use an approved SAX portal is not a valid basis for an exception. Requests based on statements such as “the client prefers Box,” “the client does not like our portal,” or “this is faster for the client” will not be approved.
Approval of an exception does not designate the third-party platform as an approved SAX storage, collaboration, or file transfer solution. Each approval is limited to the specific requester, external organization, business purpose, data type, and access period identified in the request.
SAX and client data must continue to be exchanged, stored, and managed through approved SAX platforms unless a formal exception has been submitted, reviewed, and approved. Users may not use third-party platforms for general file storage, client convenience, personal accounts, or ad hoc document exchange.
⚠️ PLEASE READ BEFORE CONTINUING — Strictly Forbidden Applications & Tools
Third-Party File Transfer & Repository Platforms
Third-party file transfer and cloud storage services — including Google Drive, Dropbox, Box, JungleDisk, and similar platforms — are not approved for use on SAX equipment or for the exchange, storage, or collaboration of SAX or client data. All data exchange must occur through SAX-approved platforms: HubSync or Suralink for documents containing PII or sensitive client data; OneDrive or SharePoint for all other business data; and GFR, Axcess, or CaseWare for tax and audit workflows. Client preference, convenience, or unfamiliarity with SAX portals is not a valid reason to use a third-party platform — and requests made on that basis will not be approved.
Third-party file transfer and cloud storage services — including Google Drive, Dropbox, Box, JungleDisk, and similar platforms — are not approved for use on SAX equipment or for the exchange, storage, or collaboration of SAX or client data. All data exchange must occur through SAX-approved platforms: HubSync or Suralink for documents containing PII or sensitive client data; OneDrive or SharePoint for all other business data; and GFR, Axcess, or CaseWare for tax and audit workflows. Client preference, convenience, or unfamiliarity with SAX portals is not a valid reason to use a third-party platform — and requests made on that basis will not be approved.
Remote Access Tools
Tools used to connect into client environments or allow connections to SAX equipment are strictly forbidden. Examples include: Splashtop, ScreenConnect, LogMeIn, GoToMyPC, VNC, TeamViewer, Citrix, and similar remote access software.
No user at SAX is permitted to download/install any application without the express review and approval through this portal as security architecture that utilizes ‘Zero Trust’ methodology is in place that will produce ‘Permissions Errors’ and/or automatically lock your equipment off the network until someone in IT Security unlocks.
Only on a case-by-case basis — once department heads understand the business need — is access to a completely SAX-isolated environment with a corporate TeamViewer license, as well as Citrix Receiver to connect to another client's environment, permitted. The client will be required to sign off on a SAX Limited Liability and Indemnification Agreement — send to support@saxtechnology.com with the client name and user names. Lead time is approximately 1 business week. Requests for these categories will be automatically denied.
Tools used to connect into client environments or allow connections to SAX equipment are strictly forbidden. Examples include: Splashtop, ScreenConnect, LogMeIn, GoToMyPC, VNC, TeamViewer, Citrix, and similar remote access software.
👤
Section 1: Requestor Information
Verified from your Microsoft 365 account
⚠ Before completing this form, please confirm with your department head that this request has been discussed and approved at the department level.
💻
Section 2: Application Overview
Provide details about the application you are requesting
⚠️ PLEASE READ BEFORE CONTINUING
🚫 Strictly Forbidden Applications & Tools
Third-Party File Transfer & Repository Platforms
Third-party file transfer and cloud storage services — including Google Drive, Dropbox, Box, JungleDisk, and similar platforms — are not approved for use on SAX equipment or for the exchange, storage, or collaboration of SAX or client data. All data exchange must occur through SAX-approved platforms: HubSync or Suralink for documents containing PII or sensitive client data; OneDrive or SharePoint for all other business data; and GFR, Axcess, or CaseWare for tax and audit workflows. Client preference, convenience, or unfamiliarity with SAX portals is not a valid reason to use a third-party platform — and requests made on that basis will not be approved.
Third-party file transfer and cloud storage services — including Google Drive, Dropbox, Box, JungleDisk, and similar platforms — are not approved for use on SAX equipment or for the exchange, storage, or collaboration of SAX or client data. All data exchange must occur through SAX-approved platforms: HubSync or Suralink for documents containing PII or sensitive client data; OneDrive or SharePoint for all other business data; and GFR, Axcess, or CaseWare for tax and audit workflows. Client preference, convenience, or unfamiliarity with SAX portals is not a valid reason to use a third-party platform — and requests made on that basis will not be approved.
Remote Access Tools
Tools used to connect into client environments or allow connections to SAX equipment are strictly forbidden. Examples include: Splashtop, ScreenConnect, LogMeIn, GoToMyPC, VNC, TeamViewer, Citrix, and similar remote access software.
No user at SAX is permitted to download/install any application without the express review and approval through this portal as security architecture that utilizes ‘Zero Trust’ methodology is in place that will produce ‘Permissions Errors’ and/or automatically lock your equipment off the network until someone in IT Security unlocks.
Only on a case-by-case basis — once department heads understand the business need — is access to a completely SAX-isolated environment with a corporate TeamViewer license, as well as Citrix Receiver to connect to another client's environment, permitted. The client will be required to sign off on a SAX Limited Liability and Indemnification Agreement — send to support@saxtechnology.com with the client name and user names. Lead time is approximately 1 business week. Requests for these categories will be automatically denied.
Tools used to connect into client environments or allow connections to SAX equipment are strictly forbidden. Examples include: Splashtop, ScreenConnect, LogMeIn, GoToMyPC, VNC, TeamViewer, Citrix, and similar remote access software.
Yes
No
⚠️ PLEASE READ BEFORE CONTINUING
🚫 Strictly Forbidden Applications & Tools
Third-Party File Transfer & Repository Platforms
Third-party file transfer and cloud storage services — including Google Drive, Dropbox, Box, JungleDisk, and similar platforms — are not approved for use on SAX equipment or for the exchange, storage, or collaboration of SAX or client data. All data exchange must occur through SAX-approved platforms: HubSync or Suralink for documents containing PII or sensitive client data; OneDrive or SharePoint for all other business data; and GFR, Axcess, or CaseWare for tax and audit workflows. Client preference, convenience, or unfamiliarity with SAX portals is not a valid reason to use a third-party platform — and requests made on that basis will not be approved.
Third-party file transfer and cloud storage services — including Google Drive, Dropbox, Box, JungleDisk, and similar platforms — are not approved for use on SAX equipment or for the exchange, storage, or collaboration of SAX or client data. All data exchange must occur through SAX-approved platforms: HubSync or Suralink for documents containing PII or sensitive client data; OneDrive or SharePoint for all other business data; and GFR, Axcess, or CaseWare for tax and audit workflows. Client preference, convenience, or unfamiliarity with SAX portals is not a valid reason to use a third-party platform — and requests made on that basis will not be approved.
Remote Access Tools
Tools used to connect into client environments or allow connections to SAX equipment are strictly forbidden. Examples include: Splashtop, ScreenConnect, LogMeIn, GoToMyPC, VNC, TeamViewer, Citrix, and similar remote access software.
No user at SAX is permitted to download/install any application without the express review and approval through this portal as security architecture that utilizes ‘Zero Trust’ methodology is in place that will produce ‘Permissions Errors’ and/or automatically lock your equipment off the network until someone in IT Security unlocks.
Only on a case-by-case basis — once department heads understand the business need — is access to a completely SAX-isolated environment with a corporate TeamViewer license, as well as Citrix Receiver to connect to another client's environment, permitted. The client will be required to sign off on a SAX Limited Liability and Indemnification Agreement — send to support@saxtechnology.com with the client name and user names. Lead time is approximately 1 business week. Requests for these categories will be automatically denied.
Tools used to connect into client environments or allow connections to SAX equipment are strictly forbidden. Examples include: Splashtop, ScreenConnect, LogMeIn, GoToMyPC, VNC, TeamViewer, Citrix, and similar remote access software.
Yes
No — Internal use only
📊
Section 3: Business Justification & Existing Tools
Verify no existing application meets your needs
⚠ Application sprawl increases security risk, licensing costs, and IT support burden. We must ensure we are not duplicating capabilities already available.
Yes
No
I'm not sure — please help determine
Yes
Scheduled
Not yet
Yes
No
💰
Section 4: Financial & Contractual Details
All cost information must be gathered from the vendor
Monthly
Annual
Multi-year
Perpetual
Usage-based
🔒
Section 5: Security & Authentication
Security is non-negotiable for financial advisory
⚠ Applications that do not support SSO/MFA integration will NOT be approved. This is a firm-wide security requirement with no exceptions.
ℹ Vendor Due Diligence Required: Contact your vendor's sales or technical team for answers to these security questions. If any answer is "Unknown," you must reach out to the vendor before submitting — unknowns will delay the review and approval process.
What is SSO (Single Sign-On)? SSO allows you to log into an application using your existing Microsoft 365 / Entra ID credentials instead of creating a separate username and password. This is critical for security because it means SAX IT can manage access centrally, enforce password policies, and instantly revoke access when an employee leaves.
Yes
No
Unknown
⚠ You need to contact the vendor and ask whether their application supports Single Sign-On (SSO) with Microsoft Entra ID / Office 365. This is a requirement for approval.
Your vendor will need to provide this information. Ask them which SSO protocol their application supports:
• SAML 2.0 — The most common enterprise SSO standard. Uses XML-based tokens to securely pass your identity between systems.
• OAuth 2.0 — An authorization framework that lets the app access resources on your behalf without sharing your password.
• OpenID Connect (OIDC) — Built on top of OAuth 2.0, adds identity verification. Very common with modern cloud apps.
• Other — Some vendors use proprietary or legacy protocols. If so, please specify below.
• SAML 2.0 — The most common enterprise SSO standard. Uses XML-based tokens to securely pass your identity between systems.
• OAuth 2.0 — An authorization framework that lets the app access resources on your behalf without sharing your password.
• OpenID Connect (OIDC) — Built on top of OAuth 2.0, adds identity verification. Very common with modern cloud apps.
• Other — Some vendors use proprietary or legacy protocols. If so, please specify below.
SAML 2.0
OAuth 2.0
OpenID Connect
Other
What is MFA (Multi-Factor Authentication)? MFA adds an extra layer of security beyond just a password. After entering your password, you must verify your identity a second way — like approving a push notification on your phone, entering a code from an authenticator app, or using a hardware key. This prevents unauthorized access even if someone steals your password.
• Native MFA — The application has its own built-in MFA (e.g., its own authenticator app or SMS codes).
• Through SSO — The application relies on Microsoft’s MFA when you sign in via SSO (this is preferred since SAX already enforces MFA through Microsoft).
• Native MFA — The application has its own built-in MFA (e.g., its own authenticator app or SMS codes).
• Through SSO — The application relies on Microsoft’s MFA when you sign in via SSO (this is preferred since SAX already enforces MFA through Microsoft).
Yes — Native
Yes — Through SSO
No
Unknown
⚠ Contact the vendor and ask if their application supports Multi-Factor Authentication, either natively or through SSO integration with Microsoft Entra ID.
SOC 2 Type II is an independent audit that verifies a vendor’s security controls (data protection, availability, confidentiality) have been tested and proven effective over time. This is the gold standard for SaaS vendor security.
ISO 27001 is an international standard for information security management systems (ISMS). It means the vendor has a formalized, systematic approach to managing sensitive data and has been certified by an accredited body.
Encryption at rest means your data is encrypted when it’s stored on the vendor’s servers or databases. Even if someone gains unauthorized access to the physical storage, they cannot read the data without the encryption key.
Encryption in transit means your data is encrypted while it’s being sent between your computer and the vendor’s servers (like HTTPS). This prevents anyone from intercepting and reading the data as it travels over the internet.
Penetration testing (pen testing) means the vendor hires external security experts to simulate real cyberattacks against their systems to find and fix vulnerabilities before hackers do. Ask the vendor if they conduct regular pen tests.
A breach notification policy means the vendor is contractually committed to notifying SAX promptly if a data breach occurs that affects our data. This is critical so we can take immediate action to protect clients.
⚠ One or more security answers are marked "Unknown." You must reach out to the vendor for this information. Submitting with unknowns will significantly delay the review and approval process.
📜
Section 6: Regulatory Compliance & Data Governance
Financial industry regulatory requirements
ℹ Your vendor should be able to answer most of these questions. Ask them about their compliance certifications, data handling practices, and regulatory support. Unknowns will delay the review process.
Select all types of data this application will store, access, or process. This determines which security and compliance requirements apply.
Your vendor will need to confirm which regulatory frameworks their software supports. These are laws and industry standards that govern how client and business data must be handled:
• GLBA (Gramm-Leach-Bliley Act) — Federal law requiring financial institutions to protect the privacy and security of client financial information. This applies to most of what SAX does.
• GDPR (General Data Protection Regulation) — EU regulation for protecting personal data of EU citizens. Applies if the software handles any data from EU-based clients.
• SEC / FINRA — Securities and Exchange Commission and Financial Industry Regulatory Authority rules for recordkeeping, supervision, and data protection in wealth management.
• SOX (Sarbanes-Oxley) — Federal law governing financial recordkeeping and reporting. Relevant if the software handles accounting or financial reporting data.
• IRS Publication 4557 — IRS guidelines for safeguarding taxpayer data. Critical for any software handling tax return information.
• GLBA (Gramm-Leach-Bliley Act) — Federal law requiring financial institutions to protect the privacy and security of client financial information. This applies to most of what SAX does.
• GDPR (General Data Protection Regulation) — EU regulation for protecting personal data of EU citizens. Applies if the software handles any data from EU-based clients.
• SEC / FINRA — Securities and Exchange Commission and Financial Industry Regulatory Authority rules for recordkeeping, supervision, and data protection in wealth management.
• SOX (Sarbanes-Oxley) — Federal law governing financial recordkeeping and reporting. Relevant if the software handles accounting or financial reporting data.
• IRS Publication 4557 — IRS guidelines for safeguarding taxpayer data. Critical for any software handling tax return information.
What is Data Residency? This refers to the physical location where the vendor runs their application servers and stores your data (e.g., data centers in the US, Europe, etc.). For financial advisory firms, it’s important to know where client data physically resides because different countries have different data protection laws. US-only data residency is strongly preferred.
US only
US + other countries
Outside US
Unknown
⚠ You need to ask the vendor where their data centers are located and where your data will be stored. This is critical for compliance — if data is stored outside the US, additional legal and regulatory review is required.
What does this mean? Some vendors include clauses in their terms of service that allow them to sell, share, or monetize the data you store in their system — including aggregated or anonymized versions of your data. This is a serious concern for a financial advisory firm handling confidential client information. Ask the vendor directly: "Do you sell, share, or monetize any of the data we store in your platform?"
What does this mean? Many software vendors now use Artificial Intelligence (AI) and Machine Learning (ML) tools. We need to know: Does the vendor use your data to train their AI/ML models? Do they share data or results with other users or third parties? What type of AI/ML technology are they using? The vendor can provide this information — check their privacy policy or ask their sales team directly.
DPA = Data Processing Agreement — a legal contract between SAX and the vendor that defines how the vendor will handle, protect, and process our data. Required for GDPR compliance and best practice for all vendors handling client data.
BAA = Business Associate Agreement — required by HIPAA when a vendor handles Protected Health Information (PHI). If this software touches any health-related data, a BAA is legally required.
The vendor must provide these documents — ask their sales or legal team.
BAA = Business Associate Agreement — required by HIPAA when a vendor handles Protected Health Information (PHI). If this software touches any health-related data, a BAA is legally required.
The vendor must provide these documents — ask their sales or legal team.
Why is this important? When you stop using a vendor’s software, you need to ensure you can get your data out (export) and that the vendor permanently deletes your data from their systems. Without this, your confidential client data could remain on a former vendor’s servers indefinitely, creating ongoing security and compliance risk.
⚠ One or more compliance answers are marked "Unknown." You must reach out to the vendor for this information. Submitting with unknowns will significantly delay the review and approval process.
🏗️
Section 7: Technical Architecture & Integration
How the application fits into our infrastructure
SaaS — Web only
SaaS + Desktop app
SaaS + Browser extension
SaaS + Mobile app
On-premises
Since this access method requires installing software (browser extension, mobile app, or desktop app), please provide the minimum system requirements for installation (e.g., OS version, disk space, RAM, browser version, mobile OS version, etc.).
Select all SAX systems this application needs to connect or share data with. If any integrations are selected, please describe how they will integrate below.
What is an API? An API (Application Programming Interface) is a way for different software systems to talk to each other automatically. We ask this because if the application has an API, SAX IT can potentially automate workflows, connect it with other systems, and build custom integrations — making it more useful and secure.
What is RBAC (Role-Based Access Control)? RBAC means the application lets administrators control what different users can see and do based on their role. For example, a manager might have access to reports that a regular user cannot see. We ask this because SAX needs to ensure that employees only have access to the data and features appropriate for their job function — this is a key security and compliance requirement.
⚠ Contact the vendor and ask if their application requires any firewall rules, port openings, IP whitelisting, or other network configuration changes to function properly.
🤝
Section 8-10: Vendor, Agreements & Acknowledgment
Support details, documentation, and sign-off
Documents Provided (check all attached)
⚠ Do NOT sign any vendor agreements before IT and Legal review. All agreements must be approved by the CIO.
📎 Upload Documents
Click or drag files here to upload
PDF, DOCX, XLSX — Max 25MB per file
Requestor Acknowledgment
📋 PLEASE READ BEFORE CONTINUING — File-Transfer Platform Exception Policy
SAX permits exceptions for the use of third-party platforms only in limited circumstances where the external platform is required by a government agency, regulatory body, court, taxing authority, state or municipal agency, or an approved business-to-business audit or examination process.
Exceptions are intended only for situations where SAX does not control the required platform and cannot reasonably use HubSync, Suralink, OneDrive, SharePoint, or another approved SAX system as an alternative.
Client preference, convenience, familiarity with another platform, or unwillingness to use an approved SAX portal is not a valid basis for an exception. Requests based on statements such as “the client prefers Box,” “the client does not like our portal,” or “this is faster for the client” will not be approved. Exception approval is based on an external requirement, not user or client preference.
Approval of an exception does not designate the third-party platform as an approved SAX storage, collaboration, or file transfer solution. Each approval is limited to the specific requester, external organization, business purpose, data type, and access period identified in the request.
SAX and client data must continue to be exchanged, stored, and managed through approved SAX platforms unless a formal exception has been submitted, reviewed, and approved. Users may not use third-party platforms for general file storage, client convenience, personal accounts, or ad hoc document exchange.
Where PII, tax documents, audit evidence, or sensitive client information is involved, users must use the appropriate approved SAX system — including HubSync, Suralink, SharePoint, OneDrive, GFR, Axcess, or CaseWare — unless an approved exception applies.
📤
File-Transfer Tool Exception Request
Formal exception for limited use of a third-party file transfer platform
⚠ This is a formal exception request. Exceptions are only granted where a third-party platform is explicitly required by an external body — government agency, regulatory authority, court, taxing authority, or approved B2B audit/examination process. Client preference, convenience, or portal dissatisfaction are not valid reasons. All sections are required unless marked optional (O).
Section 1 — Requester Information
Section 2 — Request Type
Select the type that best describes this exception request.
📌 One-time third-party platform access
🔁 Recurring third-party platform access
🏛 Standing government / regulatory access
🔍 B2B audit / examination access
⚖️ Court-ordered or legally mandated access
Section 3 — External Organization
🏛 Federal agency (IRS, SEC, PCAOB, etc.)
🏢 State agency
🏙 Municipal / local government
⚖️ Court / legal authority
📋 Regulatory body
🔍 Audited business entity (B2B)
❓ Other (must justify)
Justify why this does not fit any listed category and explain the nature of the external requirement.
Section 4 — Platform Information
Yes
No
Yes
No
Yes
No
Unknown
Yes
No
Unknown
Section 5 — Business Justification & Supporting Documentation
⚠ SAX-approved platforms — HubSync, Suralink, OneDrive, and SharePoint — must be used for all data exchange unless a documented external requirement prevents it.
Describe the specific, documented external requirement. Reference the engagement letter, IRS notice, court order, or regulatory mandate if applicable. Do not state client preference or convenience.
Be specific. “The client doesn’t use SharePoint” or “Box is easier” are not valid justifications.
Yes — the external party requires this specific platform; no alternative is available
No — SAX could potentially propose an alternative but has not done so
Upload evidence of the external requirement — engagement letters, IRS notices, court orders, regulatory communications, or similar documents.
Click or drag files here to upload
PDF, DOCX, XLSX — Max 25MB per file
Section 6 — Data Classification
Select all directions that apply to this access.
Select all types of data that will be accessed, exchanged, or viewed through this platform.
Section 7 — Users Requiring Access
⚠ Access is granted only to the individuals named here, on their specific SAX-managed equipment, for this specific engagement. Adding unnamed users constitutes a security violation.
List every SAX employee requiring access. Include full name and SAX email for each person.
Optional. List any backup or delegate users who may need access if the primary user is unavailable.
Sharing credentials or access beyond named individuals will result in automatic denial and may trigger a security incident review.
No — access is limited strictly to the named users above
Yes — access will be shared more broadly
🚫 Auto-Deny: Requests where access will be shared beyond named users will be automatically denied. Please revise to name all required individuals.
Section 8 — Access Method & Controls
ℹ All acknowledgements below are required for approval. Requests that cannot comply with these conditions will not be approved.
You confirm access will be through a browser only — no desktop client, sync agent, or standalone application will be installed on SAX equipment.
Yes — browser-only access; no installs on SAX equipment
No — a desktop application or install is required
⚠ Desktop clients, sync agents, or standalone applications cannot be installed on SAX equipment. If installation is required, this exception cannot be approved.
You confirm that no sync software (e.g., Box Drive, Dropbox app, Google Drive desktop) will be installed on SAX equipment.
Yes — no sync software will be installed on SAX equipment
No — sync software installation is planned
⚠ Sync software installation is not permitted on SAX equipment. This exception will not be approved if sync is required.
You confirm you will not use a personal (non-SAX) account to access this platform for SAX business purposes.
Yes — no personal accounts will be used for this access
No — a personal account will be used
⚠ Personal accounts may not be used for SAX business data. This exception will not be approved if a personal account is required.
You confirm your SAX Microsoft 365 credentials will not be reused or entered on this external platform. A separate, unique credential must be created and stored in Keeper.
Yes — SAX credentials will not be reused on this platform
No — SAX credentials are required for this platform
⚠ SAX Microsoft 365 credentials may not be entered on external platforms. Contact IT for SSO alternatives if the platform supports it.
Yes
No
Not applicable (view-only or agency-controlled login)
Yes — stored in Keeper
No — account not yet created
Section 9 — Duration & Review
📅 Exception Timeframe Required: Exceptions are not approved applications. All exceptions require an explicit start date and either a specific end date or a standing annual review cycle approved by SAX leadership.
📅 Specific end date
🔄 Standing — annual review required
One-time (auto-expire on end date)
Quarterly review
Annual review
Section 10 — Approvals & Acknowledgements
🚫 Auto-Deny Reminder: This request does not meet SAX exception criteria if the reason is client preference, convenience, or portal dissatisfaction. Exceptions require a documented external mandate from a government agency, regulatory body, court, taxing authority, or approved B2B audit/examination process.
Enter the full name of the partner or department head who has reviewed and approved this request at the department level prior to submission.
Acknowledgements * — all three required