Trust Center
Tax documents are some of the most sensitive data you own. Here’s how we look after them.
SendTax holds W-2s, IDs, K-1s, and the other documents you share with your preparer. This page is the single source of truth for our security program — the policies that govern it, the vendors that touch it, and how to reach us if something looks wrong.
The short version
Your documents go to your tax professional, not to us.
Our policy: SendTax staff open a customer's document only to give support you've asked for, or to fix a processing error.
Each time we do, it's logged with who opened it and why. In the app, a tax professional sees your documents only through the connection you accept.
Where we are on compliance
SendTax is a new company. Rather than wave compliance badges we haven’t earned, here is exactly where each framework stands today — and where we’re heading.
IRS Pub. 4557 / FTC Safeguards Rule
AlignedOur WISP implements the safeguards required of professional tax preparers — administrative, technical, and physical controls written down and reviewed annually.
SOC 2 Type II
In progressWe are building the control evidence catalogue that maps to the AICPA Trust Services Criteria. Audit firm to be selected after our first full operating year.
Annual third-party penetration test
PlannedExternal application + infrastructure pentest, scheduled annually and after material architecture changes. Findings tracked to closure with severity-based SLAs.
CCPA / CPRA (California)
AlignedCalifornia residents have rights under the CCPA/CPRA to access, correct, delete, and limit use of their personal information. Our Privacy Policy and Data Retention & Deletion Policy describe how to exercise them; requests go to [email protected].
GDPR / UK GDPR
N/ASendTax operates only in the United States. We do not knowingly serve EU/UK data subjects; if that changes, we will update this page first.
At a glance
The defaults that ship with every SendTax account.
- Data residency
- United States only
- All processing and storage runs in U.S. regions.
- Encryption in transit
- TLS 1.3
- Strict HSTS; modern cipher suites only.
- Encryption at rest
- AES-256-GCM
- Per-document envelope encryption; KEKs in Google Cloud KMS.
- Identity
- Clerk
- MFA for operators; customer MFA not available yet; environment-segmented.
- Access
- Row-Level Security
- Filer-owned data; access enforced in PostgreSQL, not just app code.
- Logging
- Audit trail by default
- Authentication, access, and document events kept for ≥3 years.
Policies & documents
Every policy that governs SendTax. Read them on this site, or download the PDF for your own records.
Security
How we protect customer data — controls, access, encryption, and response.
Information Security
The technical and operational controls SendTax uses to protect tax and identity information.
Access Control Policy
How access to SendTax systems and customer data is granted, reviewed, and revoked.
Encryption Policy
Cryptographic standards, algorithms, and key-management practices.
Incident Response Policy
How SendTax detects, contains, communicates about, and learns from security incidents.
Operations
How we run the service reliably and manage change.
Business Continuity & Disaster Recovery
How we keep the service available during disruption — and how we recover when something breaks.
Change Management Policy
How changes to code, infrastructure, and procedures are proposed, reviewed, and deployed.
Vendor Management Policy
How third-party vendors and sub-processors are selected, monitored, and removed.
Data handling
What we collect, how long we keep it, and how vendors are governed.
Data Retention & Deletion Policy
How long SendTax retains customer data, what triggers deletion, and how to exercise access and erasure rights.
Written Information Security Program (WISP)
The administrative, technical, and physical safeguards SendTax maintains under IRS Pub. 4557 / FTC Safeguards Rule.
Sub-processors
The third-party services that may process customer personal data on SendTax’s behalf.
Acceptable use
How the platform is meant to be used.
Who else touches your data
The third parties that process customer data on SendTax’s behalf. All Tier 1 sub-processors are U.S.-based.
Fly.io
Application hosting + managed Postgres/Redis
Cloudflare R2
Document storage (envelope-encrypted)
Google Cloud KMS
Key custody for envelope encryption
Clerk
Authentication + identity
Stripe Identity
KYC verification (government ID + selfie) — 90-day retention
Resend
Transactional + inbound email
Sentry
Error monitoring (scrubbed)
PostHog
Product analytics — no PII, no session recording
Modal
Cloud ML inference for document classification
Reach the security team
We respond to security concerns from anyone — customers, researchers, regulators. If you’ve found something that looks wrong, we want to hear about it.
Please do not include sensitive customer data (full SSN, document images) in the initial email; we’ll provide a secure channel after we acknowledge.
Security disclosures
[email protected]Vulnerabilities, suspected incidents, anything you’d rather not say in public.
Privacy & sub-processor questions
[email protected]Data subject requests, sub-processor objections, contract questions.
Everything else
[email protected]General inquiries — we’ll route from there.