TaxBlitz processes sensitive financial data — SSNs, EINs, payment amounts. Security isn't a feature. It's the foundation.
All PII (SSN, EIN, financial amounts) is encrypted at the field level using AES-256-GCM with per-tenant encryption keys. Database backups are encrypted with separate keys.
All traffic uses TLS 1.3 with HSTS headers. API endpoints enforce HTTPS. Internal service communication uses mutual TLS where applicable.
JWT-based authentication with configurable token expiration. TOTP-based two-factor authentication (2FA) available for all accounts. Account lockout after repeated failed attempts.
Role-based access control (RBAC) with distinct roles: admin, preparer, reviewer, read-only. Principle of least privilege enforced across all API endpoints.
SSN/EIN values are masked in all UI views (showing only last 4 digits). Application logs never contain unmasked PII. API responses mask sensitive fields by default.
Automated monitoring for anomalous access patterns, brute force attempts, and data exfiltration indicators. Real-time alerts and automated account lockout on suspicious activity.
Every data access, modification, form generation, filing, and admin action is logged with timestamps, user IDs, and IP addresses. Audit logs are immutable and retained for 7 years.
Hosted on Fly.io with automated deployments, health checks, and auto-recovery. PostgreSQL with automated daily backups, point-in-time recovery, and 30-day backup retention.
Security controls aligned with SOC 2 Trust Service Criteria for security, availability, and confidentiality. Formal audit planned.
Data processing agreement available. Right to erasure, data portability, and breach notification procedures in place.
California consumer privacy rights supported. Data deletion and access requests processed within 30 days.
Federal Tax Information (FTI) safeguarding requirements followed for TIN data handling and storage.
HIPAA-aligned data handling policies in place for customers in healthcare-adjacent tax scenarios.
TaxBlitz maintains 11 formal security policy documents. Enterprise customers can request copies.
Found a security vulnerability? We take reports seriously. Please email us with details and we'll respond within 48 hours.
Report a Vulnerability