Security
This product exists to handle W-2s, 1099s, and bank statements — documents where a leak isn’t an inconvenience, it’s identity theft. Here is how they’re protected, stated plainly enough to hold us to.
The strongest control: we don’t keep your data
A plain scan stores nothing — uploads are processed in memory and discarded with the result. Organization storage is opt-in, and what’s stored is deleted automatically after the organization’s retention window — 72 hours by default, configurable from 1 hour to 1 year. A breach can’t expose what no longer exists.
Encryption
TLS in transit (with HSTS). At rest, stored documents are encrypted with AES-256-GCM under a per-organization key, envelope-wrapped by a master key held outside the database — including the listing metadata (form type, tax year), so nothing extracted from a document is ever stored in the clear. Organizations can rotate their key at any time; deleting an organization’s keys is a crypto-shred that renders its remaining ciphertext permanently unreadable. Most state breach-notification laws recognise an encryption safe harbor for exactly this architecture.
Multi-factor authentication
Every browser login requires a second factor: a single-use code emailed to the account holder, with a 10-minute expiry, an attempt limit, and re-send throttling. Passwords are stored only as bcrypt hashes.
Tamper-evident audit trail
Security events — logins and failures, verification challenges, API token issuance, document access and saves, retention changes, key operations — are recorded in an append-only log where every record is HMAC-signed and carries a gap-free sequence number. Editing or deleting history is detectable, and the chain is re-verified nightly. The log records that actions happened, never document content.
AI processing without AI training
Extraction runs on Google’s Gemini API under its paid-tier terms: your documents are not used to train or improve models and are processed under a data processing agreement. We make the same commitment for ourselves — no training, no marketing use, no analytics over document content, consistent with 26 U.S.C. §7216.
Application hardening
Strict Content Security Policy (no inline script), Redis-backed rate limiting on every surface with the tightest budgets on credentials, CSRF protection on all browser flows, security headers throughout, and payment card data that never touches our servers (PCI handled by Stripe).
For firms: your compliance paperwork
CPA firms subject to the FTC Safeguards Rule can get a signed data processing agreement with incident-notification commitments, answers to security questionnaires, and a §7216 posture statement from sales@taxdocscanner.com. Self-hosted and on-premise deployments — where your documents never leave your environment — are available through the same address. Our controls are built against the SOC 2 trust criteria; a formal audit engagement is on our roadmap and its status is available on request.
Reporting a vulnerability
Found something? support@taxdocscanner.com. We commit to acknowledging reports within two business days and will never take legal action against good-faith research.