Security
Tax documents are sensitive. We treat them that way.
Encryption
- TLS 1.3 in transit
- Encryption at rest for Postgres (Supabase) and files (Google Cloud Storage)
- Generated PDFs and uploaded tax documents use signed download URLs
- Passwords hashed by the auth provider — we never see them
- HSTS, X-Content-Type-Options: nosniff, X-Frame-Options: DENY
- Tax APIs are Cache-Control: no-store
- Admin is noindex and disallowed in robots.txt
PayPal checkout
PDF unlocks are charged through PayPal. Card numbers and PayPal credentials never hit our database. We record only that a return was paid so we can unlock your download.
AI never sees your credentials
Our AI extracts tax figures from uploaded W-2s and 1099s. It never receives credentials you type: Social Security number, account password, PayPal login, or card number. The SSN goes onto your Form 1040 PDF locally, then is dropped before we save the return. CPA registrations store only the last 4 digits of SSN for identity verification. Generated PDFs and originals stay in Google Cloud Storage so you can download them with a signed link.