This page describes how TaxFigure LLC protects the data our customers entrust to us, and lists the sub-processors that support our platform. It is referenced by our Terms of Use and is intended to be read alongside our Privacy Notice.
1. Infrastructure and Hosting
The TaxFigure platform runs on Amazon Web Services in the us-east-1 region in the United States. Customer data is stored and processed in the United States.
2. Encryption
- In transit: traffic to and within the platform is encrypted using TLS. Certificates are monitored for expiry.
- At rest: storage volumes, database backups, and our evidence store are encrypted using AWS Key Management Service.
3. Access Control
- Administrative access to production requires multi-factor authentication.
- Administrative sessions are conducted through AWS Systems Manager Session Manager, are attributable to a named identity, and are logged. No administrative SSH access is exposed to the public internet.
- Application accounts are individually provisioned, and account provisioning and removal are scripted.
- Password requirements and multi-factor enrolment are enforced by policy on administrative accounts.
4. Monitoring and Detection
We operate continuous monitoring across the production estate, including:
- Threat detection and anomaly monitoring on the cloud control plane;
- Continuous vulnerability scanning of hosts and installed packages;
- File integrity monitoring on production hosts, with alerting on unexpected change;
- Centralised logging, with alerting on system availability, capacity, and security events;
- Network flow logging.
Alerts are delivered to an operations channel and reviewed on a recurring cadence, with dispositions recorded.
5. Vulnerability Management
We maintain a documented vulnerability management policy with defined remediation timeframes based on severity. Dependency vulnerabilities are monitored continuously across our source repositories, and operating-system and package vulnerabilities are scanned on an ongoing basis.
6. Backup and Recovery
- Automated daily, weekly, and monthly backups, encrypted with AWS Key Management Service;
- Logical database backups in addition to volume-level snapshots;
- Restore procedures are documented and have been tested against production data.
7. Compliance
TaxFigure is undergoing a SOC 2 Type II examination. The observation period runs from August 1, 2026 to October 31, 2026, with the report expected in early 2027. We are happy to discuss our control environment with customers and prospective customers under NDA in the meantime.
8. Sub-processors
We engage the third parties below to provide and support the platform. This list is maintained as our arrangements change. Sub-processors are engaged to perform services on our behalf and are not permitted to use customer data for their own independent purposes.
Infrastructure
Amazon Web Services
Cloud hosting, storage, backup, and logging for the entire platform. Processes all data held in the platform. United States.
Document processing
RunPod · Unstract (LLMWhisperer)
Optical character recognition and text extraction from uploaded tax documents. Processes customer document content.
Artificial intelligence and search
OpenAI · Anthropic · Google · Perplexity · Groq · OpenRouter · Vercel AI Gateway · Cohere · Fireworks · Exa · Qdrant
Language-model inference, embeddings, search, and vector storage supporting platform features. May process prompt content, which can include customer tax context.
Product and communications
Stripe · Resend · PostHog · Upstash
Payment processing and subscription billing (Stripe); transactional email (Resend); product analytics (PostHog); session and cache storage (Upstash).
Notice of changes. We will update this list when we add or replace a sub-processor. Customers who wish to be notified of changes may write to security@taxfigure.com and we will add them to a notification list.
9. Reporting a Security Issue
If you believe you have found a security vulnerability or have a security concern about the platform, please contact security@taxfigure.com. We will acknowledge your report and keep you informed of our progress. We ask that you give us a reasonable opportunity to investigate and remediate before public disclosure.
10. Contact
General security questions: security@taxfigure.com
Privacy and data-protection questions: privacy@taxfigure.com