Security & compliance
Filing a return means handing over the most sensitive paperwork you own — your Social Security number, your passport, your immigration history and your income. This page sets out the law that governs how we handle it, and the specific technical and administrative controls we run to satisfy that law.
Last reviewed August 4, 2026. Reviewed at least annually and whenever our data handling materially changes.
1. The law we operate under
TaxBuddy prepares U.S. federal tax returns for nonresident aliens. That places us under four distinct obligations, which are often confused with one another:
The Gramm-Leach-Bliley Act (GLBA)
A federal law requiring financial institutions to protect customer data. Under it, a business that prepares tax returns is a financial institution — regardless of how small it is. There is no threshold we fall under.
The FTC Safeguards Rule (16 CFR Part 314)
The Federal Trade Commission's implementation of the GLBA. It sets out the specific elements a security program must contain, and requires that the program be written down. That written document is a WISP — a Written Information Security Plan. Nothing is filed with anyone; the obligation is to maintain it and produce it on request. Ours is built on IRS Publication 5708, the template the IRS publishes for tax practices. Section 3 below maps each requirement of the Rule to what we do.
IRC § 7216 and § 6713
A federal criminal statute, with a parallel civil penalty. A tax preparer may use your return information only to prepare your return. Any other use or disclosure requires your written consent first. Section 4 covers how we obtain it.
State breach notification laws
Every U.S. state requires notice to affected individuals, and usually to the state, after a breach of personal information. These sit alongside the federal duties, not underneath them. Section 7 sets out who we notify.
We also follow IRS Publication 4557 (Safeguarding Taxpayer Data) and IRS Publication 1345 as guidance, and NISTIR 7621 for the rules of conduct our personnel work under.
2. What we collect, and why
We collect only what preparing your return requires. For a nonresident filer that is a wider set than for a citizen, because residency and treaty eligibility turn on immigration history:
- Identity: your name, Social Security number or ITIN, and date of birth.
- Immigration: your passport number, visa classification, and the I-20 and I-94 records establishing your presence and status. We treat this at the same sensitivity as your SSN — for our filers, an immigration record carries consequences beyond financial identity theft.
- Income: the W-2, 1042-S and 1099 documents you upload, and the figures read from them.
- Payment: your bank routing and account number, and only where you have chosen direct deposit for a refund we have already calculated. We do not ask for bank details before there is a refund to pay.
- Contact: your email address.
We do not collect payment card details, and we do not run advertising or analytics that profile you.
3. How we meet the FTC Safeguards Rule
The Rule sets out the required elements of an information security program at 16 CFR § 314.4. Each is reproduced below with the control that answers it.
Designate a qualified individual to oversee the program
Responsibility for the information security program rests with a named principal of the firm, together with a designated spokesperson for client and regulator communications in the event of an incident. Both designations are recorded in our WISP.
Base the program on a written risk assessment
Our WISP carries a written risk assessment covering the PII we hold, where it lives, the internal and external ways it could be lost, and the sufficiency of the controls against each. It is re-performed on review and whenever our data handling materially changes.
Access controls — restrict access to those who need it
Filer data is isolated per account by row-level security policies enforced inside PostgreSQL, on both the filings table and the document store. Access is a property of the data, not of the page requesting it, so an application defect cannot expose one filer's return to another. Administrative access to processor consoles is limited to the firm's principals.
Inventory the data, personnel, systems and devices you hold
Our WISP enumerates every system that holds PII, the categories it holds, its provider and region. Because we collect only what a Form 1040-NR requires, that inventory is deliberately short: one database, one private document store, and the processors listed below.
Encrypt customer information in transit and at rest
All traffic to the application and onward to every processor is carried over TLS. Filing data and uploaded documents are encrypted at rest by the storage provider. Documents are held in a private bucket that is not addressable from the public internet and is reachable only through an authenticated, policy-checked path.
Adopt secure development practices for in-house applications
TaxBuddy is developed in-house under version control with peer review. Credentials are held in environment configuration and never committed. Real filer data is never used in tests or fixtures. Every tax figure is produced by a deterministic engine covered by a golden-file test suite that runs against known-good returns.
Implement multi-factor authentication for system access
Every account requires authentication before any filing data is reachable, and administrative access to our processors' consoles is protected by multi-factor authentication at the provider. Multi-factor authentication is not yet available on filer accounts; it is specified in our WISP and carries the highest priority in our remediation register, but we will not describe it as in place until it is.
Securely dispose of customer information no later than two years after last use
We hold no paper records, so disposal is entirely electronic: deletion from the database and from the document store. Retention periods and the disposal procedure are set out in our WISP and reviewed against the IRS's own record-retention expectations.
Adopt change management procedures
Changes reach production through version control and review. Changes to the tax engine, to any form module, or to a PDF field map additionally invalidate the cached document packet, so no filer can be served a return generated under superseded logic.
Monitor and log authorised user activity
Event logging is enabled across the systems that process PII, and access to filer data is attributable to an authenticated account. Model reads of a document are recorded with the account and the source file they relate to.
Regularly test or monitor the effectiveness of safeguards
Controls are exercised continuously by the application itself — the isolation policies above are enforced on every request, not audited after the fact — and are re-examined on each review of the program.
Train personnel to carry out the program
Everyone with access to PII is trained on the plan before access is granted and at least annually after that, and acknowledges the rules of conduct in writing. The acknowledgement form is an attachment to our WISP.
Oversee service providers by contract
Three processors touch your data, all named below, and we hold a signed data processing agreement with each. Those agreements bind them to process only on our instructions, keep your data in the United States, retain nothing beyond what delivering the service requires, never use it to train their models, and never sell or share it. We keep the processor list deliberately short so that oversight is a real activity rather than a paperwork exercise.
Evaluate and adjust the program
The program is reviewed at least annually and whenever our business practices or systems materially change. Findings are recorded with an owner and a target date and tracked to closure.
Maintain a written incident response plan
Our WISP contains a written incident response plan covering investigation, containment, the notification list set out further down this page, a mandatory post-incident review, and the resulting amendments to the plan itself.
Report to the governing body at least annually
The individual responsible for the program reports on it at least annually to the firm's principals, covering the risk assessment, control effectiveness, incidents, and outstanding remediation.
Notify the FTC of a security event affecting 500 or more consumers within 30 days
Our breach notification plan names the Federal Trade Commission alongside the IRS Stakeholder Liaison, state authorities and affected filers, with the reporting route and the 30-day clock written into it. The clock starts at discovery, so the first step of our incident procedure is to record when and how we found out.
4. IRC § 7216 — consent to use or disclose
Before any of your tax return information reaches a third party, we ask for your written consent. This is not a formality we have bolted on; it is a criminal statute and the consent has a prescribed shape.
- The disclosure is presented before you can reach the filing flow. It is not buried in a terms document.
- It names individually every company we disclose your return information to, and states exactly what each one receives, rather than referring to unnamed 'third-party service providers'. It separately tells you that the software runs on hosting infrastructure that handles your data without storing it — that is part of our own systems rather than a disclosure, and we say so instead of leaving it out.
- Your consent is voluntary, and the statute forbids us conditioning preparation of your return on it. Declining means we cannot run automated reading of your documents; it does not shut you out of the product.
- We record the moment you consented together with a version identifier for the exact wording shown to you, so that a later change to our copy cannot obscure what you actually agreed to.
- We ask once per person rather than once per filing, so consent you have already given is not re-collected as a matter of routine.
- We do not use filer data for marketing, and we publish no statistics derived from it — aggregated or otherwise. Both are uses requiring separate consent under § 7216, and we do not seek that consent.
5. Technical safeguards in detail
Isolation is enforced by the database, not the application
Row-level security policies attached to the filings table and to the document store restrict every row and every stored file to the account that owns it. The check runs inside PostgreSQL on every query. This matters because it means a defect in a page, an API route or a cache cannot leak one filer's return to another — the database refuses the read regardless of what the application asks for.
Documents are never publicly addressable
Uploads go to a private bucket, namespaced per user, with no public URL. There is no unguessable-link scheme to be leaked or indexed, because there is no link.
No AI model computes a number on your return
Language models are used for exactly one task: reading text off your documents. Every monetary figure — brackets, treaty limits, withholding, your refund — is computed by deterministic code with a test suite behind it. The same documents always produce the same return. This is an accuracy control, and it is a security control too: it bounds what a manipulated, hallucinated or prompt-injected model response can do to a filed return.
Documents are read more than once and the readings compared
Each document is read by more than one model and by more than one input path, and the results are compared. Disagreements are recorded and reviewed. This exists to catch a misreading before it reaches a filed return.
Nothing is saved until you confirm it
The routes that read your documents return what they found; they do not write it. Extracted values reach your return only after you have seen them on screen and confirmed them. You remain the person who decides what your return says.
6. Who else touches your data
Three companies, and that is the complete list. We deliberately keep it that way: every additional processor is another contract to enforce and another place your documents exist. Two of them store your data; the third runs the software itself, so your documents pass through it without ever being written down there.
We hold a signed data processing agreement with each of them. Under those agreements they may process your data only on our instructions, must keep it inside the United States, may retain nothing beyond what delivering the service requires, and may never use it to train their models or sell or share it with anyone else. Those are contractual obligations, not assurances.
Supabase, Inc.
Database, authentication and document storage. Receives: your filing data and your uploaded documents. Processed in United States.
Amazon Web Services
Document parsing and model inference (Bedrock). Receives: your uploaded documents and the text read from them. Processed in United States (us-east-1).
Vercel Inc.
Application runtime — it runs the software you are using. Receives: your data in transit and in memory while a request is being handled; nothing is stored there. Processed in United States.
Your data also goes to the federal and state tax authorities — that is the point of the exercise, and it is the one disclosure that needs no separate consent because it is the preparation of your return.
Adding a processor means updating this list and the § 7216 disclosure before it receives anything. There are no silent additions.
Separately from the above, we use a transactional email provider to deliver messages you send us through the contact form. It receives your email address and what you write; it never receives your tax documents or your return.
7. If something goes wrong
We maintain a written incident response plan. On determining that PII has been lost or taken, we investigate and contain, then notify:
- The IRS Stakeholder Liaison, who coordinates the IRS response to a tax professional data breach.
- The Federal Trade Commission, for any security event affecting 500 or more people, as soon as possible and no later than 30 days from discovery.
- The relevant state Attorney General's office and state tax agencies.
- The FBI's Internet Crime Complaint Center, where the incident involves electronic data theft.
- Local law enforcement, our insurers and our legal counsel.
- The affected filers themselves, so they can protect their credit and identity.
Because our filers are nonresident aliens, many of whom have left the United States by the time they would need to be told, notification is by email first rather than by post. Every incident triggers a mandatory review and, where it is warranted, an amendment to the plan itself.
8. Retention and deletion
We hold no paper records containing your information. You upload documents electronically and print your completed return yourself; a printed return never passes through our hands.
Electronic records are kept for as long as preparing, supporting and re-supplying your return requires, and no longer. The Safeguards Rule sets an outer limit of two years after the last use of the information, subject to legitimate business need and legal retention requirements; our retention periods and disposal procedure are set out in our WISP. If you want your data deleted, ask us and we will do it.
9. What TaxBuddy is not
TaxBuddy is software. It is not a tax advisor, and it does not give tax advice. You are the preparer of your own return and the person who signs and files it — review it before you do. Nothing on this page is legal or tax advice, and none of it changes your own obligations to the IRS.
The IRS expects you to keep a copy of your signed return for three years. We store the packet we generated and you can download it again, but we cannot store your signed copy — that one is yours to keep.
10. Program governance
The program is reviewed at least annually and whenever our business practices or systems materially change. Where a review identifies a control that needs strengthening, it is recorded with an owner and a target date and tracked to closure — the Safeguards Rule treats a security program as something continuously assessed rather than finished, and so do we.
Our WISP is maintained as an internal document and produced to the IRS on request. We do not publish it in full: the Publication 5708 template ends in a systems inventory and a named personnel access list, and publishing that would be a map for an attacker rather than a reassurance to a filer. Its substance, minus those attachments, is what this page sets out.
To request a copy, ask a question, or report a security issue, get in touch. Related documents: privacy policy and disclaimer.