We don't see your receipts. We don't read your bank transactions. Even if an employee opened the database directly, they'd see encrypted gibberish — nothing decrypts without your login. Plain English first — tech depth below.
Tax data is the most sensitive data you own. So our default isn't "trust us" — our default is "we built it so you don't have to".
If we receive a legally binding court order, we cooperate to the minimum extent the law requires — and notify you, unless that order legally prohibits us from doing so. Every such request is recorded internally. We will publish a Transparency Report once we have meaningful numbers.
You photograph a receipt with the mobile app, drag a PDF into the browser, or forward an invoice email to your private TaxItEasy address.
Before it lands in our database, it's encrypted with a key that belongs only to your account. The key lives in a vault that only your logged-in account can open.
Sent over an encrypted connection (HTTPS) to our servers in Frankfurt, Germany. Your data does not leave Europe.
The server stores the encrypted file. We cannot read its contents. Only you can decrypt it again — by logging in.
You click "Delete account". Your account is locked the same second — nobody can log in, including you. We send you a restore link by email.
For 30 days you can change your mind: click the restore link, your account is back as if nothing happened. After 30 days, the restore link expires.
On day 31, your encryption key is deleted. Every receipt, invoice, bank transaction, OCR output, 2FA secret and email-integration token tied to your account becomes mathematically unreadable — for us, for our backups, forever. Your email address is anonymised so no one can connect old records to you.
What stays: a small audit trail ("user X deleted account on date Y") for legally required retention periods. The trail contains no financial content — only timestamped action records. We're required to keep this by tax law. After the retention period (see card below) it's removed automatically.
Tax law requires us to keep certain records even after you delete your account. We keep the bare minimum, with no financial content.
| Document & invoice audit entries | 10 years |
|---|---|
| Bank-transaction audit entries | 10 years |
| Account / login / share audit entries | 2 years |
| General system audit entries | 6 months |
| IP addresses in audit log | Anonymised after 90 days |
| Stripe billing records | Per Stripe's retention policy (legally required for tax) |
Your data lives in Frankfurt, Germany — in a data center operated by DigitalOcean (FRA1 region). It does not leave the European Union. We do not transfer storage to the United States.
The single exception is the AI extraction step: when we read what's on your receipt (vendor, amount, VAT, etc.), we send the document to the Anthropic Claude API in the United States — for the few seconds of processing — under EU-U.S. Data Privacy Framework + Standard Contractual Clauses, in zero-retention mode (Anthropic does not keep your document content). After extraction, your data goes back to Frankfurt and stays there.
If you're a CISO, IT lead, data-protection officer or just curious — here's what's under the hood.
All encryption uses AES-256-GCM, the same standard banks and governments use.
If we ever need to delete a customer's data permanently — for a GDPR right-to-erase request, for example — we delete their Account Key. The instant that key is gone, every receipt, every invoice, every transaction belonging to that company becomes mathematically unrecoverable. We don't have to track down every database row. The data is shredded by losing its key.
Beyond document content, we encrypt sensitive individual fields directly in the database:
Even if someone gained read-only access to the database, these fields would be unreadable without the per-account keys.
We don't currently hold third-party security certifications. Here's where we are and where we're going. Honest dates, not aspirational ones.
Pre-submission hardening shipped 27 April 2026 (token revocation on disconnect, Svix-signed webhooks, SPF/DKIM verification, fail-closed encryption requirements). Formal CASA Tier 2 verification is scheduled to complete by end of Q2 2026 (30 June 2026).
Verification by 30 June 2026We are evaluating whether to pursue SOC 2 Type I in late 2026. SOC 2 is primarily relevant for US enterprise buyers; our current focus is EU mid-market. We will publish a firm date if and when we engage an auditor. No date yet.
Decision in H2 2026ISO 27001 typically takes 9–18 months and €30–80k. We will not pursue it in 2026. We may revisit in 2027 once revenue justifies the spend. We will publish a clear plan if and when this changes.
Not in 2026 roadmapLast pentest: April 2026 (internal pre-submission review). First independent third-party pentest is scheduled for Q4 2026. Findings summary will be published on this page (raw report on request to enterprise customers under NDA).
Independent pentest Q4 2026Every inbound email to your private TaxItEasy address is verified with SPF and DKIM before we open it. Our webhook endpoint requires Svix-signed requests — unsigned requests are rejected with HTTP 503. Attachments are virus-scanned with ClamAV before they touch your account.
Today we offer Revolut Business via direct OAuth integration. Statement upload (CSV/PDF) works with any bank. Multi-bank Open Banking via GoCardless and pan-EU PSD2 connectors are on the roadmap for 2026. We never store your bank login credentials — only OAuth tokens, encrypted with your Account Key.
We use a small, named set of sub-processors:
The full list with locations, transfer mechanisms and DPA references is on our sub-processors page. Customers are notified before any new sub-processor is added (14-day objection window).
Available on request to [email protected]. We document categories of data, lawful bases, retention periods, sub-processors, encryption design and breach procedures.
If you've found a security issue, we want to hear about it. We follow the RFC 9116 security.txt standard — our machine-readable contact lives at /.well-known/security.txt.
taxiteasy.org and all sub-domainsapp.taxiteasy.org (web app)api.taxiteasy.org (REST API)in.taxiteasy.org (inbound email)We do not currently run a paid bug bounty programme. We may launch one once independent pentesting is in place (Q4 2026). For now we offer public credit (Hall of Fame) and direct communication with the team.
We thank the following researchers for responsibly reporting security issues:
This list is empty so far — we'd love to add you. Email [email protected].