How we protect your documents

Every upload travels over an encrypted HTTPS (TLS) connection and is stored in a private storage bucket that is encrypted at rest with AES-256 by our hosting provider. The bucket is not public: there is no listable index and no permanent file URL. When you or a member of our team opens a document, we mint a one-off link that stops working after 15 minutes.

Your intake page lives behind a long, random, unguessable link that only you receive by email. Nothing about it is indexed by search engines. If you invite someone else to send documents on your behalf, that link is separate, expires on a schedule you choose, and can be revoked in one click.

Staff access is behind an authenticated sign-in with row-level database security, so a person can only reach the records they're entitled to see. Automated jobs — reminders and scanning — run with narrowly scoped credentials.

Every document records when it was uploaded, what the scanner read, the confidence for each field, the exact text it came from, and every correction you made — with timestamps. You can view that history on your page and export it as CSV or JSON whenever you like.

Every uploaded document is stamped with a delete-after date of three years from the day you upload it — you can see that date next to each file on your secure page. A job runs every night and permanently deletes any file past that date, along with the text our scanner read from it. The only exception is a file we're legally required to preserve (for example, an open IRS examination); in that case we place the file on a documented hold and tell you why.

Before we transmit any return, the IRS requires your signed Form 8879 e-file authorization. If you sign remotely, we first verify your identity with questions built from your own documents, and we record the time, IP address and device with your signature, as IRS Publication 1345 requires. The finished form is stored in a separate private bucket with a SHA-256 fingerprint so any later alteration would be detectable, and our system will not let a return be marked as transmitted until that signature exists.

• Delete any document you uploaded, at any time.
• Re-run a scan if a result looks wrong.
• Confirm or correct every extracted value before it touches your answers.
• Download a complete PDF summary of everything we hold for your appointment.

Don't forward your secure link to anyone you don't want seeing your file, and let us know right away if you think a link has been shared by mistake — we'll rotate it immediately.