Security
We publish this page so you can verify that our security posture matches what you expect from a service handling tax-return inputs.
Credentials
- bcrypt-hashed passwords.
- Dummy compares for non-existent emails to reduce timing enumeration risk.
- Rate limits on sign-in and sign-up flows.
Sessions
- HS256 JWT in an httpOnly cookie with SameSite=Lax (required for the Google sign-in redirect).
- Secure flag under HTTPS.
- Origin checks on state-changing requests guard against cross-site use.
- JWT_SECRET required for production boot.
Access control
- Every API route scopes reads and writes by userId.
- Sign-up cannot elevate a user to admin.
- Admin pages require an admin role.
CSRF & origin checks
- State-changing API calls check the Origin header, with SameSite cookies as a second layer.
Input validation
- Amounts are bounded and must be finite integers.
- Wizard-answer keys are whitelisted.
- UUID path parameters are validated before use.
Where your progress data lives
- In-progress return data is stored in internal PostgreSQL.
- Nothing is stored in browser localStorage.
- When AI is enabled, Kemuri-protected content is sent to the configured US AI provider (Anthropic, OpenAI, or xAI).
- Generated PDFs are streamed on demand and not retained server-side.
Kemuri (AI identifier protection)
- Before chat or review text leaves our application servers for the AI provider, names, emails, phones, dates of birth, residence-card and corporate numbers, employer names, bank accounts, and address-like strings are tokenized or masked.
- My Number (12 digits) is hard-redacted — including spaced, dotted, and full-width forms — and the request is refused outright if one cannot be removed.
- Outbound payloads are mainly amounts, flags, and numeric/boolean wizard fields.
My Number handling
- The current public version does not collect or store My Number digits (consent flags only).
- Even if form printing later requires a number field, we do not retain a reusable My Number value as normal account data.
Reporting a vulnerability
Our public reporting channel is still being updated and will appear here once configured.
Not tax advice
This site is NOT tax advice — it is a tool to help you prepare your own filing. Always verify amounts before submitting.