Security
We publish this page so you can verify that our security posture matches what you expect from a service handling tax-return inputs.
Credentials
- bcrypt-hashed passwords.
- Dummy compares for non-existent emails to reduce timing enumeration risk.
- Rate limits on sign-in and sign-up flows.
Sessions
- HS256 JWT in an httpOnly cookie with SameSite=strict.
- Secure flag under HTTPS.
- JWT_SECRET required for production boot.
Access control
- Every API route scopes reads and writes by userId.
- Sign-up cannot elevate a user to admin.
- Admin pages require an admin role.
CSRF & origin checks
- State-changing API calls check the Origin header, with SameSite cookies as a second layer.
Input validation
- Amounts are bounded and must be finite integers.
- Wizard-answer keys are whitelisted.
- UUID path parameters are validated before use.
Where your progress data lives
- In-progress return data is stored in internal PostgreSQL.
- Nothing is stored in browser localStorage or sent to third-party backends.
- Generated PDFs are streamed on demand and not retained server-side.
My Number handling
- Processed only with explicit opt-in.
- Encrypted at rest with a separate key.
- Deleted within 24 hours of package generation or on request.
Reporting a vulnerability
Our public reporting channel is still being updated and will appear here once configured.
Not tax advice
This site is NOT tax advice — it is a tool to help you prepare your own filing. Always verify amounts before submitting.