SECURITY ARCHITECTURE
Security is the architecture, not a feature
A system that handles taxpayer data can’t rely on “being careful.” TaxPin’s safeguards are enforced at the database layer, not in application code — not options that can be switched off, but structure that cannot be bypassed.
Core safeguards
Encrypted in transit & at rest
Every document travels over TLS and is stored with AES-256 encryption. Plaintext files never sit anywhere on our servers; both database and storage are encrypted at rest.
Complete firm isolation (RLS)
Multi-tenant isolation is enforced by PostgreSQL Row-Level Security, not application code. Every query on every table is firm-scoped, so another firm’s data simply isn’t returned. Writes (INSERT/UPDATE) are also bound to the firm↔client relationship, not just reads.
Expiring signed links
There are no permanent public URLs. Every view and download goes through a signed link that expires within minutes, and the storage path is validated on both the firm and client segments.
Two-factor authentication (MFA · aal2)
Authenticator-app MFA is available to both preparers and clients. The point is the database, not the UI — once a factor is enrolled, the DB requires an aal2 session, so a password alone cannot reach any data.
Tamper-proof audit log
Uploads, downloads, deletions, profile changes, team changes, consent changes, and internal notes are all recorded automatically. The log is append-only and cannot be edited or erased by the application.
Automatic sign-out
Sessions end after 30 minutes of inactivity, so nothing lingers on a shared or public computer.
No documents in email
Notification emails never carry attachments — only “check your portal.” Even a compromised inbox exposes no documents.
Transport security headers
Content-Security-Policy, HSTS, X-Frame-Options (clickjacking protection), and nosniff are applied on every route. Server-only secrets (service keys, SMTP, SMS tokens) are never sent to the browser.
The path of a single document
Upload
A client snaps a photo; the browser sends it over TLS. File type and size (25MB) are validated, and the storage path is bound to that client and firm.
Encrypted storage
Stored with AES-256. No public URL is ever created.
Notify
The preparer gets a “new document” alert — no attachment, just a portal link.
Access
Only authorized users open it via a signed link that expires in minutes. Views and downloads are recorded in the audit log.
Delete
Deleting removes it from both sides, and the deletion itself is recorded in the audit log.
Who can see what
Compliance posture
How TaxPin maps to the controls U.S. tax-data regulations require.
The IRS guide for tax pros on safeguarding taxpayer data. The system backs its core requirements: encryption, multi-factor authentication, access controls, automatic lock-out, and access logging.
Requires access controls, encryption, multi-factor authentication, activity monitoring, and change management — met via RLS access control, encryption in transit/at rest, MFA, and audit logs.
Our Privacy Policy includes the GLBA privacy notice.
TaxPin covers the technical controls of a firm’s Written Information Security Plan (encryption, access control, MFA, logging), helping your firm build its plan.
An honest boundary — shared responsibility
If you have security questions or need due-diligence materials, reach out anytime.
Have more questions?
Ask us anything about security and compliance.