This page describes how TaxFigure LLC protects the data our customers entrust to us, and lists the sub-processors that support our platform. It is referenced by our Terms of Use and is intended to be read alongside our Privacy Notice.
1. Infrastructure and Hosting
The TaxFigure platform runs on Amazon Web Services in the us-east-1 region in the United States. This describes our AWS hosting, not a US-only guarantee for all third-party processing. Sub-processor processing locations and outstanding confirmations are described in section 8 below.
2. Encryption
- In transit: traffic to and within the platform is encrypted using TLS. Certificates are monitored for expiry.
- At rest: storage volumes, database backups, and our evidence store are encrypted using AWS Key Management Service.
3. Access Control
- Administrative access to production requires multi-factor authentication.
- Administrative sessions are conducted through AWS Systems Manager Session Manager, are attributable to a named identity, and are logged. No administrative SSH access is exposed to the public internet.
- Application accounts are individually provisioned, and account provisioning and removal are scripted.
- Password requirements and multi-factor enrolment are enforced by policy on administrative accounts.
4. Monitoring and Detection
We operate continuous monitoring across the production estate, including:
- Threat detection and anomaly monitoring on the cloud control plane;
- Continuous vulnerability scanning of hosts and installed packages;
- File integrity monitoring on production hosts, with alerting on unexpected change;
- Centralised logging, with alerting on system availability, capacity, and security events;
- Network flow logging.
Alerts are delivered to an operations channel and reviewed on a recurring cadence, with dispositions recorded.
5. Vulnerability Management
We maintain a documented vulnerability management policy with defined remediation timeframes based on severity. Dependency vulnerabilities are monitored continuously across our source repositories, and operating-system and package vulnerabilities are scanned on an ongoing basis.
6. Backup and Recovery
- Automated daily, weekly, and monthly backups, encrypted with AWS Key Management Service;
- Logical database backups in addition to volume-level snapshots;
- Restore procedures are documented and have been tested against production data.
7. Compliance
TaxFigure is undergoing a SOC 2 Type II examination. The observation period runs from September 1, 2026 to October 31, 2026, with the report expected in early 2027. We are happy to discuss our control environment with customers and prospective customers under NDA in the meantime.
8. Sub-processors
We engage the third parties below to provide and support the platform. This list is maintained as our arrangements change. Sub-processors are engaged to perform services on our behalf and are not permitted to use customer data for their own independent purposes.
Location disclosure revised September 16, 2026 (revision 2). Locations below distinguish service hosting from wider processing and identify confirmations still outstanding.
Infrastructure · United States (us-east-1)
Amazon Web Services
Cloud hosting, storage, backup, and logging for the entire platform. Processes all data held in the platform.
Document processing · United States
RunPod
Optical character recognition and the privacy vault that detects and tokenises personal information. Every document uploaded to the platform passes through both. Processes customer document content.
Artificial intelligence
OpenAI · Fireworks · Google · Perplexity · Cohere
Language-model inference, embeddings, and reranking behind the assistant, the document pipeline, and research features. These process prompt and document content, which can include customer tax context. OpenAI and Fireworks carry the largest share; Google’s Gemini serves an output-parsing step; Perplexity answers research queries composed from conversations; Cohere reranks document passages.
- OpenAI: its published processing locations include the United States and other countries. US-only processing has not been verified for our API usage.
- Fireworks: the vendor states that it has US servers, but processing locations for our serverless inference have not yet been verified. Its deployment-region options do not establish the routing of our serverless requests; US-only inference is not confirmed.
- Google: processing locations for our Gemini API usage have not yet been verified.
- Perplexity: processing locations for our API usage have not yet been verified. Its consumer privacy notice does not cover processor-side API data.
- Cohere: its Trust Center states that service hosting is on Google Cloud Platform in US-Central. This identifies hosting, not every support or onward-processing location, and is distinct from the vendor’s Canadian domicile.
Product and communications
Stripe · Resend · PostHog
Payment processing and subscription billing (Stripe); transactional email (Resend); website and product analytics, and text-masked session replay on the Platform (PostHog, United States). Our Cookie Notice describes what PostHog collects and how to opt out.
- Stripe: its DPA provides for transfers to Stripe, LLC in the United States and onward transfers globally to affiliates and sub-processors as needed to provide services. This is not a US-only processing commitment.
- Resend: customer data is stored in the United States, where its primary processing operations take place. Sending-region selection controls email routing, not storage; our sending region has not been confirmed in this disclosure.
- PostHog: we use US Cloud. Its published service chain also includes subsidiaries in the United Kingdom and Germany; US hosting does not mean that every service-provider activity is confined to the United States.
Engineering
GitHub
Source control and continuous delivery. Automation workflow definitions are exported to a private company-owned repository nightly. Processing locations for our use of GitHub have not yet been verified.
Sign-in
Microsoft · Google
Identity providers for optional single sign-on. They receive the account identity you choose to sign in with. They do not receive tax content through this sign-in integration. Processing locations for our Microsoft and Google sign-in integrations have not yet been verified.
Ended relationships
Vercel AI Gateway · Groq · LangSmith · Unstract (LLMWhisperer) · Netlify
Listed for completeness, because they appeared in earlier versions of this page or held data during 2026. The Vercel AI Gateway and Groq were retired on September 9–10, 2026 and replaced by Fireworks; LangSmith tracing was removed on September 2, 2026. Management confirmed that Unstract was used only for testing, not production, and retired before September 1, 2026. Netlify hosted our marketing site until September 2, 2026 and our help centre until its migration to our AWS hosting on September 16, 2026.
Removed from this list
Anthropic · OpenRouter · Exa · Qdrant · Upstash
Named on earlier versions of this page. We measured each one and found no flow of customer data to it, so they are no longer listed as sub-processors.
Which parties this authorises. Section 7 of our Data Processing Addendum and section 12 of our Terms of Use refer to the sub-processors listed here. That means the cards above Ended relationships only. The last two cards are published for transparency — they are parties we no longer use, or never sent customer data to — and nothing in them is an authorisation to process your data.
Processing locations. These disclosures are maintained from our internal sub-processor register using vendor publications and service-specific evidence. A hosting location is not a guarantee that inference, support, or onward processing takes place only there. Unverified locations are expressly identified above; we do not infer them from a vendor’s headquarters or transfer safeguards. Confirmations remain outstanding and will be added as obtained. This is the location disclosure referenced by section 11 of our Data Processing Addendum.
Notice of changes. We will update this list when we add or replace a sub-processor. Customers who wish to be notified of changes may write to security@taxfigure.com and we will add them to a notification list.
9. Reporting a Security Issue
If you believe you have found a security vulnerability or have a security concern about the platform, please contact security@taxfigure.com. We will acknowledge your report and keep you informed of our progress. We ask that you give us a reasonable opportunity to investigate and remediate before public disclosure.
10. Contact
General security questions: security@taxfigure.com
Privacy and data-protection questions: privacy@taxfigure.com