Trust & security
Trust & security
What protects your clients' records today, and what is planned. We list facts, not badges.
In place today
What protects records now
Tenant isolation
Every office's data is scoped at the database level with row-level security. One office cannot read another's clients, cases or documents.
Encrypted identifiers
Social Security numbers and similar fields are stored encrypted with only the masked form readable. Revealing one is permissioned and recorded.
Two-step verification
Staff sign in with a password and a code from an authenticator app. Repeated wrong guesses are locked out; idle sessions end automatically.
Append-only audit log
Sensitive actions — sign-ins, reveals, approvals, permission denials — are recorded and cannot be edited or deleted.
Consent-gated disclosure
Overseas support staff see masked queues, and only for clients who gave Form 7216 consent.
Human approval everywhere
No code path files a return, sends a message or charges a fee without a person approving it. Simulated steps are labeled on screen.
Nightly encrypted backups
The database is backed up nightly with encryption, and restores are tested.
Security headers and HTTPS
All traffic is served over HTTPS with strict transport security and standard browser protections.
Planned
What we're working toward
Listed as planned until it exists. We don't show badges we haven't earned.
Independent audit (SOC 2)
Planned. We will publish the report when it exists, not before.
Off-site backup copies
Planned: encrypted copies in a second provider.
E-signature vendor
Planned: an e-sign provider behind the existing authorization step.
The full write-up is in our security page. Report a concern to support@taxharbor.com.
Ask us the hard questions.
Bring your security checklist to the call.
