Core safeguards
Encrypted in transit & at rest
Every document travels over TLS and is stored with AES-256 encryption (keys managed by the infrastructure provider). Both database and storage are encrypted at rest, and file access is governed by per-firm row-level security and expiring signed links.
AI & sensitive data
Tax forms such as W-2s, 1099s and IDs are read with AWS Textract. The file is sent directly for processing and is not stored in our AWS account, and that AWS account is opted out of AWS using customer content to develop or improve its AI services. When text goes to Claude (Anthropic API) for statement parsing, notice reading or drafting, SSNs are masked entirely and long account numbers are cut to the last four digits first. SSNs and TINs read from documents are sealed with AES-256-GCM, shown only in masked form, and revealed in full only after two-step verification, with an audit record.
Identity verification for remote signing (KBA)
Only when the firm turns on identity verification (KBA) for a remote Form 8879 signature, a window from our provider BoldSign opens. The client answers credit-record-based questions there and signs; BoldSign receives the signer name, email and the form to be signed. Answers do not pass through TaxPin servers, and we keep only the pass or fail result and the verification record. After 3 failed attempts the signing moves to an in-person visit or paper.
Upload cleaning and virus scanning
Photos and PDFs uploaded by clients are re-saved by the server as new files. Photos lose location and device data; PDFs lose JavaScript, attachments and open-on-load actions. If the cleaned result looks different from the original, the original is kept. Every file (including files sent by the firm) is then scanned for viruses with AWS GuardDuty, and a file sent by the firm becomes visible to the client only after the scan finishes. If a threat is found, the file is quarantined, only a notice page remains, and the firm is notified.
Complete firm isolation (RLS)
Multi-tenant isolation is enforced by PostgreSQL Row-Level Security, not application code. Every query on every table is firm-scoped, so another firm’s data simply isn’t returned. Writes (INSERT/UPDATE) are also bound to the firm↔client relationship, not just reads.
Expiring signed links
There are no permanent public URLs. Every view and download goes through a signed link that expires within minutes, and the storage path is validated on both the firm and client segments.
Two-factor authentication (MFA · aal2)
Authenticator-app MFA is available to both preparers and clients. The point is the database, not the UI — once a factor is enrolled, the DB requires an aal2 session, so a password alone cannot reach any data.
Tamper-proof audit log
Uploads, downloads, deletions, profile changes, team changes, consent changes, and internal notes are all recorded automatically. The log is append-only and cannot be edited or erased by the application.
Automatic sign-out
Sessions end after 30 minutes of inactivity, so nothing lingers on a shared or public computer.
No documents in email
Notification emails never carry attachments — only “check your portal.” Even a compromised inbox exposes no documents.
Transport security headers
Content-Security-Policy, HSTS, X-Frame-Options (clickjacking protection), and nosniff are applied on every route. Server-only secrets (service keys, SMTP, SMS tokens) are never sent to the browser.
The path of a single document
Upload
A client snaps a photo; the browser sends it over TLS. File type and size (25MB) are validated, and the storage path is bound to that client and firm.
Encrypted storage
Stored with AES-256. No public URL is ever created.
Notify
The preparer gets a “new document” alert — no attachment, just a portal link.
Access
Only authorized users open it via a signed link that expires in minutes. Views and downloads are recorded in the audit log.
Delete
Deleting removes it from both sides, and the deletion itself is recorded in the audit log.
Who can see what
Compliance posture
How TaxPin maps to the controls U.S. tax-data regulations require.
The IRS guide for tax pros on safeguarding taxpayer data. The system backs its core requirements: encryption, multi-factor authentication, access controls, automatic lock-out, and access logging.
Requires access controls, encryption, multi-factor authentication, activity monitoring, and change management — met via RLS access control, encryption in transit/at rest, MFA, and audit logs.
Our Privacy Policy includes the GLBA privacy notice.
TaxPin covers the technical controls of a firm’s Written Information Security Plan (encryption, access control, MFA, logging), helping your firm build its plan.
An honest boundary — shared responsibility
If you have security questions or need due-diligence materials, reach out anytime.