Why the compliance questions come first
Location decides which 7216 rules apply. A preparer outside the United States needs client consent before disclosure, and for Form 1040 series returns the SSN must be masked under 301.7216-3(b)(4). A provider that cannot explain its process here is not ready for US tax work.
The Safeguards Rule then requires you to select providers capable of appropriate safeguards and to require those safeguards by contract, under 16 CFR 314.4(f).

