Security Details

These are the controls that protect your Tax-Aid Filing account and your data.

Compliance

Payment Card Security (PCI DSS)

• The Payment Card Industry Data Security Standard (PCI DSS) sets the rules for handling credit and debit card data.
• Card numbers never reach our servers. They are tokenized in your browser and sent directly to our PCI DSS Level 1 certified payment processor.

California Consumer Privacy Act (CCPA)

• The CCPA gives California residents rights over their personal information: to know what is collected, to access it, and to request deletion.
• We honor these rights. Tax records required under IRS retention rules are kept for the required period and deleted afterwards.
• We do not sell personal information.

Account Security

• Required Two-Factor Authentication: Every account must use two-factor authentication with standard authenticator apps or passkeys.
• Bot Protection: Sign-up, password reset, and sign-in after failed attempts require server-enforced human verification.
• Session Protection: Idle sessions end automatically; every sign-in requires your second factor.
• Team Isolation: Each team's data is kept separate; team roles control member visibility and permissions.

Data Protection

• Encryption in Transit: All traffic between browser and Tax-Aid Filing uses TLS encryption.
• Encryption at Rest: All stored data is encrypted; sensitive fields receive additional encryption with hardware security module keys.
• Private Infrastructure: Database, cache, and file storage are accessible only over private networks.
• Edge Protection: Traffic passes through Cloudflare with web application firewall filtering.
• Backups: Encrypted, stored separately with restricted access and fixed retention schedules.
• Tamper-Evident Audit Trail: Sign-ins, administrative actions, and sensitive data access are recorded in append-only, cryptographically chained logs verified daily.
• Email Security: Email uses SPF, DKIM, and DMARC authentication.

Fraud Prevention

Identity Verification

Before purchasing, users verify identity with government-issued ID and selfie checked by verification partners. Only results are kept; documents and photos aren't stored.

Address Verification

Addresses are checked against U.S. Postal Service records.

Payment Monitoring

Every payment attempt is recorded to identify patterns like card testing.

Development and Operations

• Automated Checks: Every change passes automated testing and static analysis before deployment.
• Least-Privilege Access: Production access is limited to necessary personnel; deployment pipelines cannot access encryption keys.
• Monitoring: Application errors and security events are monitored in real time.