Security
Your clients' documents, kept private.
A tax portal holds some of the most sensitive paperwork a person has. This page explains exactly how TaxFiler protects it, without marketing language.
- Encryption in transit
- Every page and file is served over HTTPS with HSTS. Firms' own domains get their own certificates.
- Encryption at rest
- Documents are encrypted with AES-256-GCM before they're written to disk, in 1 MB chunks that each carry an authentication tag. A file that has been altered, truncated or swapped between accounts fails its check and is never served.
- Storage outside the web root
- Files live outside anything the web server can serve, under random names. They can only be downloaded through an access check, and every view and download is logged.
- Isolation between firms
- Every record belongs to one firm, and every query is scoped to it. A signed-in session is pinned to one workspace and is discarded if it's presented anywhere else.
- Least privilege
- Clients see only their own return, files and conversation. Staff see their firm's clients. Only owners manage billing, branding, team and exports.
- Two-step sign-in
- Authenticator-app codes (TOTP) with one-time recovery codes. Each code works once. Firms can require it for all staff.
- Passwords
- Stored as bcrypt hashes. Sign-in, reset and code entry are rate-limited per account and per network. Reset links expire after an hour and work once.
- Web protections
- Every form and action carries a CSRF token. A strict Content-Security-Policy, framing protection and content-type protections are sent on every response.
- Secrets
- Two-step seeds and payment keys are sealed with the platform key before they reach the database.
- Documents are never sent for processing
- When staff read figures from a form, the document is read in their own browser. It isn't uploaded to any OCR or AI service.
Your responsibilities
Turn on two-step sign-in for your team, remove staff who leave, and keep your own devices updated. Everything else runs on our side.
Report a vulnerability
If you believe you've found a security issue, email security@taxfiler.space. Please don't access other people's data while testing. We reply within two business days.