Security overview
This page is written for your Written Information Security Plan (WISP, IRS Publication 5708). It says how Taxporch is built, what the platform does for you, and what your firm still owns. Inside the app, Settings → Security & audit has a ready-made WISP vendor annex filled in with your firm's details.
Provider: WS SOLUTIONS LLC. Questions: support@taxporch.com.
Architecture in one paragraph
Taxporch runs as one application on a small, dedicated virtual machine in a United States cloud region, behind a web server that only accepts encrypted connections. Your data sits on a persistent disk attached to that machine. Documents and stored secrets are encrypted by the application before they touch the disk. The key that unlocks them is not stored on the data disk: it is injected at start-up from the cloud provider's secret manager. Backups go to a storage bucket in a second US region, encrypted with a separate backup key. There are no third-party scripts, trackers or ad tags in the app or on this website.
Where your data is
- Hosting: a United States region of our cloud provider, with backups in a second US region.
- Access: only WS SOLUTIONS LLC staff located in the United States can reach production systems, and only to run and support the service. Support staff open client documents only when you ask for help on a ticket, and that access is logged.
- Canada: there is no Canadian data region yet. Canadian firms' data is stored in the United States. The T183 sheet has notice text you can give your clients.
Encryption
- In transit: TLS 1.2 or newer on every connection, with HSTS so browsers never fall back to plain HTTP.
- Documents at rest: every file gets its own random 256-bit key and is encrypted with AES-256 (CTR mode) plus an HMAC-SHA256 integrity check. The per-file key is itself encrypted ("wrapped") with the master key.
- Secrets at rest: API tokens and similar secrets are encrypted the same way.
- Database: stored on a disk encrypted by the cloud provider. The database holds only wrapped file keys, never the master key.
- Master key: generated once, kept in the cloud secret manager and in a root-only file on the server, never on the data disk or in backups.
- Backups: encrypted again with AES-256 using a separate backup key before they leave the server.
Sign-in and access control
- Two-step verification is required for every firm user (authenticator app codes, with one-time recovery codes). It cannot be switched off.
- Clients sign in with a one-time email link or a password, and can turn on two-step verification. You can encourage it in your welcome email.
- Passwords are hashed with PBKDF2-SHA256 at 600,000 iterations. Sign-in attempts are rate-limited and locked out after repeated failures.
- Idle sign-out: after 30 minutes for staff and 15 minutes for clients.
- Roles: owner, admin and staff. Staff can be limited to the clients they work on.
- Every form is protected against cross-site request forgery. A strict content security policy blocks injected scripts.
- There are no public file links. Downloads go through an access check and are logged.
Audit log
The audit log records sign-ins, document views and downloads, shares, signatures, deletions, permission changes and settings changes, with time, user and IP address. Each entry is chained to the one before it with a hash, so an edit or deletion of past entries is detectable. Owners and admins can filter it and export it to CSV at any time.
Backups and recovery
- Database: an online backup every hour, encrypted and copied to a bucket in a second US region.
- Documents: already encrypted files are synced to the same bucket every hour.
- Disk snapshots: daily.
- Retention: backups are kept for 30 days, then deleted automatically.
- Targets: we aim to lose at most one hour of data (recovery point) and to be back within one business day after a total loss of the server (recovery time). Restores are rehearsed before launch and then every quarter.
Retention and deletion
- Signed Form 8879 and 8878 are locked for at least 3 years; Form T183 for at least 6 years. You can set longer periods and a firm-wide default, and put any document on legal hold.
- When a document is permanently deleted, its key is destroyed ("crypto-shredding"), so the file can no longer be read, and the deletion is logged. Copies inside backups expire within 30 days.
- When you close your account you can export everything first. See the Service Provider Addendum for the return and deletion timeline.
Payments
Clients pay invoices on Stripe-hosted checkout pages, into your own Stripe account. Card and bank details are entered on Stripe's pages, never on ours, and Taxporch never sees or stores card numbers.
Incidents
- If we confirm a security incident that affects your firm's data, we notify you within 48 hours of confirming it.
- The notice says what happened, when, which kinds of data and how many of your clients are affected (by state or province), and what we are doing. It gives you what you need for the FTC notification form, the IRS (through your Stakeholder Liaison), state notices and, for Canadian firms, the Privacy Commissioner.
- We keep a register of every incident, including small ones, for at least 5 years.
Testing and change management
- Code changes are reviewed and tested before release; an automated test suite runs on every change and covers access isolation between firms.
- Operating-system security updates are applied automatically.
- An independent penetration test is planned before general availability; we will share a summary under NDA once it is done.
Sub-processors
The final list is confirmed before launch, and we tell you at least 30 days before we add a new one.
| Purpose | Provider | Location | Data |
|---|---|---|---|
| Hosting, backups, secret storage | Google Cloud (to be confirmed) | United States | All service data, encrypted as described above |
| Transactional email | Postmark or Amazon SES (to be chosen) | United States | Recipient email address and a notice with no tax data |
| Client payments | Stripe, on your own Stripe account | United States | Payment details, handled on Stripe's pages |
| Remote identity checks for Form 8879 | KBA provider (to be contracted) | United States | Name, address, date of birth and SSN, sent straight to the provider and never stored by us |
FTC Safeguards Rule mapping
Tax preparers are "financial institutions" under the FTC Safeguards Rule (16 CFR Part 314). The rule is your firm's program; Taxporch helps you meet the parts that live in your client portal. This table shows who does what.
| 16 CFR 314.4 | What the platform does | What you still do |
|---|---|---|
| (a) Qualified Individual | Gives the named person admin tools and the audit log | Name your Qualified Individual |
| (b) Risk assessment | This page and the WISP annex describe the platform's controls | Write and review your risk assessment |
| (c)(1) Access controls | Roles, per-client access for staff, idle sign-out, lockout | Decide who gets access; remove leavers the same day |
| (c)(2) Inventory of data and systems | Lists what data the portal holds and where | List Taxporch in your WISP with your other systems |
| (c)(3) Encryption | TLS 1.2+ in transit; AES-256 per-file encryption at rest; encrypted backups | Keep office devices encrypted; send documents through the portal, not email |
| (c)(4) Secure development | Reviewed, tested releases; this overview on request | Evaluate us as an external application once a year |
| (c)(5) Multi-factor authentication | Required for every firm user; available for clients | Protect your own email and devices with MFA |
| (c)(6) Disposal | Retention timers, legal hold, crypto-shredding with a deletion log | Set your retention period; approve purges |
| (c)(7) Change management | Release process and change log | Track changes to your own systems |
| (c)(8) Monitoring and logging | Hash-chained audit log of user activity, exportable | Review the log periodically |
| (d) Testing | Our own monitoring and planned penetration testing | Test your own systems (exempt below 5,000 consumers) |
| (e) Training | Plain-language help pages | Train your staff |
| (f) Service providers | Security terms in the Service Provider Addendum | Sign it, and review us periodically |
| (g) Program updates | We tell you about material changes | Update your WISP |
| (h) Incident response plan | Our own plan; 48-hour notice to you | Keep your written plan (exempt below 5,000 consumers) |
| (i) Report to the board | Not applicable | Report as the rule requires |
| (j) FTC notification | Notice with the facts the FTC form asks for | File with the FTC within 30 days when 500+ consumers are affected |
What your firm still owns
- Your WISP, your Qualified Individual and staff training.
- Who on your team has access, and removing access when people leave.
- The security of your own computers, phones and email.
- Checking a client's identity when they sign in person or for CRA purposes.
- The decision to e-file: your tax software transmits the return, not Taxporch.
- Any IRC 7216 consents for uses beyond preparing the return.
- Your incident response and the notices you must send.
What we don't claim
We do not have an independent attestation report or a certification for Taxporch yet. No tax agency approves or certifies client portals, so we never say one does. Claims on this page describe how the service is built; the contract terms are in the Service Provider Addendum.