Security

Encryption

Every stored value — answers, extracted document values, uploaded files and export artifacts — is encrypted with AES-256-GCM before it is written, in addition to the encryption the storage provider applies.

The key is not shared. One master key is held in a secrets manager, and a distinct key is derived from it for each account. One account’s data cannot be decrypted with another account’s key, and there is no per-account key material sitting anywhere to be stolen.

Each ciphertext is additionally bound to its exact location, so a stored value cannot be moved to another record — or another account — without the decryption failing loudly.

Isolation between accounts

Data is addressed by account, not filtered by it: everything you own lives under your account identifier, so reading someone else’s data would require asking for the wrong account rather than forgetting a filter. Storage rules enforce the same boundary independently of the application code.

Asking for a session that is not yours returns “not found”, not “forbidden” — confirming that something exists is itself a disclosure.

Logs

Social Security and Employer Identification numbers are masked to their last four digits anywhere they might appear in a log line, and the masking is applied at the logging layer rather than at each call site, so a value that escapes through some other path is still redacted on the way out.

Service boundaries

Tax Forms runs as three separate services, split by what each one would expose if it were compromised:

• The service that reads your documents holds the language model credentials and nothing else.
• The service that renders PDFs holds no keys and reads no stored data — values arrive in the request and leave in the response.
• Only the main service can decrypt your stored data.

All three run only when there is work to do and shut down when there is not.

The audit trail

Every fill, every override, every question and every approval is recorded in an append-only trail. No entry can be altered or removed on its own, so the trail can never be made to say something that did not happen — the storage rules enforce that independently of the application.

Deleting the form deletes its trail along with it. That is the one way the record goes away, it takes the whole session with it, and it only happens when you ask for it.

Reporting something

If you find a way to reach data that is not yours, or anything else that looks wrong, say so. Include what you did and what you saw; you do not need to prove impact first.