Trust
Security & Trust
Last updated 2026-06-10
CA firms handle PAN, GSTIN, bank statements, notices, and audit files. This page describes, concretely and not in marketing language, what Taxayu does to protect that data, and what is next on our security roadmap.
1. Transport and infrastructure
- All traffic is served over HTTPS (TLS). Plain-HTTP requests are not accepted.
- The application runs on Vercel's managed infrastructure; we do not operate our own exposed servers.
- Every response carries hardened security headers (Content-Security-Policy, Strict-Transport-Security (HSTS), X-Frame-Options, and related protections), set centrally in middleware.
- Secrets (database credentials, AI provider keys, auth secrets) live in server-side environment configuration and are never shipped to the browser.
2. Authentication
- Sign-in via email/password or Google OAuth, built on NextAuth.
- Passwords are hashed with bcrypt, never stored or logged in plain text.
- Two-factor authentication (TOTP) with single-use recovery codes, enabled per user from Settings → Security.
- Sessions use signed JWTs; signing keys are server-side secrets.
- Authentication and password-reset endpoints are rate-limited to slow down credential-stuffing and enumeration attempts.
- Password-reset tokens are single-use and expire.
- Staff join a firm workspace by admin invite; there is no way to self-join someone else's workspace.
3. Roles and access control
Every workspace member has exactly one role, enforced server-side on every API route, not just hidden in the UI:
| Role | Access |
|---|---|
| Firm Admin | Workspace settings, member invites and removal, all clients, all modules, exports |
| Chartered Accountant | Prepare and review work, manage clients, run all modules, export outputs |
| CA Staff | Prepare assigned work, run modules, upload documents |
| Viewer | Read-only access to reports and workings (no edits, no exports of client masters) |
| Client (portal) | Client-portal namespace only: upload requested documents, view their own status. Never sees the firm workspace or other clients |
Client-portal users sit below every firm role in the permission hierarchy: their session can only reach the portal namespace, never firm-side data.
4. Tenant isolation
Every record (clients, filings, documents, computation results) is scoped to your firm's workspace ID at the database layer. Workspace-scoped API routes resolve the workspace from the authenticated session, not from client-supplied parameters, so one firm's data cannot be addressed from another firm's session.
5. Audit logs
Administrative and membership actions (invites, role changes, member removal, session revocation, workspace changes) are recorded in an append-style audit log with the acting user and timestamp. Audit coverage is being extended to uploads, exports, deletions, and AI generations.
6. Files and retention
- Transient parsing uploads are processed in bounded temporary storage and cleaned up. Documents a user deliberately saves are retained in private storage and served only through authorized download routes.
- Computation results, audit logs, and workspace records are retained for the life of the account so your working history stays reconstructable.
- Account and workspace deletion is handled by an authorized firm administrator or support request rather than an unverified self-service action. See the Privacy Policy for the full retention description.
7. AI subprocessors
AI features are invoked explicitly; nothing is sent to an AI provider in the background. Workspace content is not used to train third-party AI models. Every AI output is labelled as a draft requiring CA review.
| Provider | Purpose | What it receives |
|---|---|---|
| Google (Gemini) | Document classification, extraction, drafting aids | Only the document text relevant to the feature you invoke |
| Anthropic (Claude) | Drafting and analysis aids | Only the document text relevant to the feature you invoke |
| OpenAI | Drafting and analysis aids | Only the document text relevant to the feature you invoke |
8. Calculation accuracy
- Tax engines are deterministic, versioned code, not AI guesses. Each engine carries a version identifier so an output can be traced to the rules that produced it.
- Engines are covered by automated test suites, including certification tests against worked examples (GSTR-1/3B exports, TDS/FVU validation, surcharge and interest math), run in CI on every change.
- High-liability and AI-assisted workflows are documented in their module descriptions, and all outputs require professional review before filing or client delivery.
9. Security roadmap
What we are building next:
- Google SSO domain restrictions per workspace.
- Direct portal/API filing via GSP and ERI integrations.
- A formal data-processing agreement (DPA), available on request today.
- An in-product retention dashboard showing exactly what is stored per workspace.
10. Reporting a vulnerability
If you find a security issue, email chirayumate@gmail.com with steps to reproduce. Please do not test against other firms' data; use a workspace you created with dummy data. We respond to security reports with priority.