Security
Where is my data stored?
Supabase Postgres in us-east, with row-level security on every table. Uploaded documents sit in private storage behind access-controlled routes; Stripe handles payment data.
Updated September 2026
Your tax-return inputs and engine outputs live in Supabase Postgres (us-east). Row-level security scopes every row to the owning user; the case tables are reachable only through server routes that check who you are first.
Statements and documents you upload go to private storage over an encrypted connection and are served back only through access-controlled links tied to your case — never a public URL. Sensitive fields (and any brokerage access token, once the Plaid connection opens) are encrypted at the application layer with AES-256-GCM before they reach the database.
Payment data goes directly to Stripe — we never see your card number. We store only the Stripe customer ID and the payment status of your return.
Full retention, deletion, and third-party detail is in the privacy policy.
Full guide
Ready to see what your return looks like?
The diagnostic, supported calculations, and in-wizard summary are free. Payment is required to generate the PDF package.
Still stuck? Email us.