Security at idutax
Tax documents contain some of the most sensitive financial information your clients have. We built idutax with security as a first principle, not an afterthought.
Encryption at rest and in transit
Files are encrypted at rest in Cloudflare R2, and data in transit is protected with TLS. Encryption keys for stored files are managed by Cloudflare.
Where your data is stored
Files are stored in Cloudflare R2 (eastern North America) and the database runs on Neon in US East (N. Virginia). idutax does not currently offer storage in Canada, the UK or the EU. If that matters for your firm, ask us before you sign up.
Privacy law: built with it in mind
We design with PIPEDA (Canada), UK GDPR and the GLBA Safeguards Rule (US) in mind. We are not certified against any of them. UK firms are data controllers for their clients' files and we act as processor; see our sub-processor list for who handles data.
Audit log
Uploads and key actions are logged with who, what and when. Export the log from your account for regulatory or internal review.
Access controls
Team members only see the clients and documents their firm gives them access to. Each client portal link is unique to that client.
No SOC 2 report yet
idutax has not completed a SOC 2 audit. We build on infrastructure providers that publish their own independent audit reports, and we can answer security questionnaires on request.
Report a vulnerability
We take security reports seriously. If you believe you have found a security vulnerability in idutax, please contact us at security@idutax.com. We commit to acknowledging reports within 24 hours and to working with you to understand and address the issue promptly.