Security

Your tax file holds some of the most private things you have. This page says how Taxr protects it. Found a security problem? Write to support@taxr.ai.

Signing in

There is no password to steal. You sign in with Google, or with a code texted to your mobile number.
Taxr checks Google’s sign-in on its own server: Google’s signature, that it was made for Taxr, and that it hasn’t expired.
A texted code works once, expires after 10 minutes, and stops working after too many wrong tries. Sign-in attempts from one place are limited.
An old taxr.ai account joins your file only when you sign in with the same Google account it was made with, never by typing an email address.

Staying signed in

Your session is a long random key kept in a cookie your browser won’t hand to scripts. Taxr stores only a fingerprint of it, never the key itself.
A session ends after 7 days without use, and after 30 days in any case. Logging out ends it on Taxr’s server, not only in your browser.
Every request that changes something must come from Taxr’s own pages; requests from other sites are refused.

Your documents

Your file is stored privately under your account, with Amazon Web Services in the United States, where stored files are encrypted at rest. Only your own session opens it.
Each file Taxr makes for you is checked against the fingerprint it was saved with before it’s handed to you.
Taxr never asks for your full Social Security number, your passwords or your bank logins. When a W-2 prints a whole SSN, Taxr keeps only its last four digits.
Your file is kept until you ask for it to be deleted (see the Privacy Policy).

Your bank and your email

A bank is linked through Plaid: your bank login goes to Plaid, never to Taxr. Taxr reads transactions only, to spot your refund deposit; it can’t move money.
Email and file sources (Gmail, Google Drive, Outlook, OneDrive, Box) are connected with read-only access: Taxr can’t send, change or delete anything in them.
The access keys for your bank and your sources are encrypted (AES-256-GCM) before they’re stored. Disconnecting one deletes Taxr’s key for it.

Payments

You pay in Stripe’s own card form. Taxr never sees or stores your card number.
A payment counts only when Stripe confirms it, in a message Taxr checks is signed by Stripe.

The AI that reads your file

Your documents and messages are processed by an AI model through a provider that does not keep them or use them for training.
Taxr’s agent works in a workspace that holds your file and no one else’s. It reads your sources read-only, drafts emails and letters for you to send, and never files, sends, pays or contacts the IRS for you.
Its web lookups are for the public internet only: Taxr refuses any address on its own servers or a private network.

Watching how the site is used

Taxr uses Hotjar to see where its pages confuse people. Hotjar is set to hide all the text on the page, so the words in your documents and what you type aren’t recorded.