Security and data processing summary

Program

We keep a written information security plan built on IRS Publication 5708 and the FTC Safeguards Rule, with a named Qualified Individual, a risk assessment and an incident response plan.

Accounts and access

Passwords are stored only as salted scrypt hashes. Sessions are random tokens stored hashed, revocable, and expire after 7 idle days. Every request is checked on the server against your role; a CPA firm sees a builder's studies only while the builder's relationship with it is active.

Our reviewers hold one review role each; the same person cannot sign both the CPA and the engineering review of a study. Two-step sign-in is required for staff.

Data handling

Uploaded files are parsed in memory and not stored; we keep the extracted figures. Paid documents are locked until payment and each download is checked again. Released studies keep a record of the exact inputs, data versions and outputs so a document can be reproduced.

The review log and security logs are append-only. We do not use your tax information for anything but your studies without your signed consent.

Payments

Card entry happens on Stripe's hosted page. We never see or store card numbers.

Providers that process data for us

Hosting and database (United States), file storage (United States), email delivery: Postmark (United States), payments: Stripe (United States), error reporting (United States, no personal data), AI assistant: Anthropic (United States; sample data and library only, no client data). Providers are bound by contract to confidentiality and to use data only to serve us.

Incidents

We follow a written incident response plan. If unencrypted customer information is acquired without authorization we notify affected customers, the FTC (within 30 days when 500 or more people are affected), the IRS and states as their laws require.

Report a problem

Write to support@buildertaxstrategies.com with "security" in the subject. We acknowledge within one business day.