Data processing agreement
Last updated September 26, 2026
This agreement forms part of the terms of service between TaxFiler and each firm that uses it. It applies to personal data about a firm's clients that the firm puts into its workspace.
1. Roles
The firm decides why and how its clients' personal data is processed and is the data controller (a "data fiduciary" under India's Digital Personal Data Protection Act, 2023). TaxFiler processes that data only to provide the service, on the firm's behalf, as its processor.
2. Instructions
We process client data only to host the firm's workspace and deliver what the firm and its clients do in it: storing documents, sending the messages and emails they trigger, collecting signatures and recording payments. We don't use it for any other purpose, don't sell it, and don't use it to train any model.
3. Confidentiality
Only people who need access to operate or support the service can reach client data, and they are bound by confidentiality. We do not look at a firm's documents unless the firm asks us to, or the law requires it.
4. Security
We protect client data with encryption in transit and at rest (AES-256-GCM for documents), strict separation between firms, role-based access, two-step sign-in, rate limiting and an audit log of access. The security page describes these measures in detail.
5. Sub-processors
We use a small number of providers to run the service:
- Our cloud hosting provider, which runs the servers and stores the encrypted data.
- Our email delivery provider, which sends the emails the service generates.
- Razorpay, for subscription payments made to us.
We will give firm owners notice by email before adding a sub-processor that handles client data, so they can object.
6. Personal data breaches
If we become aware of a breach affecting a firm's client data, we will tell the firm without undue delay, describe what happened and what data is affected, and help the firm meet its own obligations to notify its clients and regulators.
7. Helping with requests
Firms can export, correct and delete their clients' data from the workspace. If a client contacts us directly, we will pass the request to the firm and assist where the firm needs our help.
8. Deletion
When a firm closes its account, we delete its workspace data within 90 days, including backups as they cycle, unless the law requires us to keep it. Firms can export everything before closing.
9. Information and audits
On reasonable written request, we will provide the information a firm needs to show that this agreement is being followed.
Contact
Data protection questions: privacy@taxfiler.space.