COMPANY
Born inside
a tax practice
TaxPin started as a tool a tax firm built for its own clients.
Our story
Every tax season, the same thing happened. Documents scattered across email and text messages, clients called to ask "did you get it?", and the office worried about sensitive data sitting in attachments.
TaxPin began as a tool a tax firm built for its own clients to fix exactly that. Not flashy features — just documents moving safely, and a clear view of who sent what. That was the whole idea.
Tax documents are among the most sensitive files anyone handles. A Social Security number, a year of income, a bank account — information that can't be taken back once it leaks, all gathered in a single file. So from day one our goal was never a good-looking portal, but the safest possible vault.
We believe convenience only matters when it rests on top of security. Every feature in TaxPin — down to a single upload or notification — is built only after we've decided how the data is encrypted, isolated per firm, and logged. Here is how those principles are actually implemented.
SECURITY BY DESIGN
Document security
Tax documents hold Social Security numbers, income, and bank details — the kind of information that leads straight to identity theft if it leaks. Every design decision in TaxPin starts from that premise.
Encrypted in transit and at rest
Every file is encrypted from the moment it's uploaded and stays encrypted once stored on the server. There's no point where documents sit in the clear.
Complete firm-to-firm isolation
Multi-tenant isolation (RLS) separates each firm's data at the database level. One firm's account can never see another firm's documents — the database enforces this, not just the application code.
Multi-factor authentication
A password alone won't reach your data. MFA is bound to the data-access policy itself, not just the screen — so even a direct call that skips the UI is blocked.
Expiring download links
Documents can only be downloaded through signed links that expire after a short window. Even if a link is shared or leaked by mistake, it can't be reused.
Full audit logging
Every upload and download is recorded — who, what, and when — so you can trace exactly what changed if you ever need to.
Repeated security review
We hold the line with penetration-minded code audits, security headers (CSP, HSTS, and more), a 30-minute idle logout, and upload type and size validation.
All of it is designed around the principles the IRS and FTC require for protecting tax data.
WHAT WE BELIEVE
How we work
Security first
Security is the architecture, not an option. Encryption, isolation, and MFA are enforced at the database layer.
Focused by design
We do one thing — secure tax-document exchange — and do it well, without bloat. Not widening the attack surface with features no one uses is part of security too.
Multilingual by default
Built for the Korean-American community and for English- and Spanish-speaking clients — every client screen ships in three languages, and messages are translated as they travel.