How your data is protected

Tax App holds financial records, so it is reasonable to ask where that data goes and who can see it. This page describes what the app does with your information, not how it is built inside. Some details are kept private on purpose, because publishing them would help attackers more than it would help you.

Encryption

• In transit: every connection to the app and the API uses HTTPS (TLS). There is no unencrypted access.
• At rest: your records are stored in AWS data centres in Auckland, New Zealand, with storage-level encryption enabled, and are backed up automatically every day to a vault that is also in New Zealand. Inland Revenue (IRD) rules keep business records in New Zealand by default. They also allow offshore storage with IRD approval or through an IRD-approved provider. They also allow offshore backups where the main records stay in New Zealand. We keep both the records and the backups in New Zealand.
• Stored credentials: the few secrets the app stores on your behalf, such as bank feed access tokens, are also encrypted with AES-256-GCM before they are written to the database. The keys that unlock them are held in server configuration, separate from the database. These values are never shown again after you save them. They are never included in API responses or data exports. The app shows only a masked hint, so that you can recognise which token is saved.

Passwords and sign-in

• Passwords are encrypted in your browser before they are sent, on top of HTTPS. They are stored only as salted one-way hashes using Argon2id, a modern password-hashing method. Nobody, including us, can recover your password from what is stored.
• You can sign in with Google instead of using a password. You need a password only if you later change your sign-in email.
• Sign-in and sign-up are rate-limited to slow down password guessing. You can see and end your active sessions in Settings at any time.

Read-only bank feeds

• Bank feeds connect through Akahu, a New Zealand open-banking provider. You connect your bank to Akahu directly. Your internet banking username and password are never entered into Tax App and never pass through our systems.
• Tax App holds only Akahu access tokens. They can read transactions and balances for the accounts you choose. They cannot move money.
• The tokens are stored with the extra AES-256-GCM encryption described above. They are checked with Akahu before they are saved.
• You can cancel access from your Akahu account at any time, or disconnect in Tax App, which deletes the stored tokens straight away. Either way, your records and reconciliations stay as they are.

Private documents

Invoices, tenancy agreements, and other uploads are kept in private storage with no public web addresses. Opening a document creates a new link that works for a few minutes and then expires. Attachment links inside PDF reports you share expire after 14 days.

Who can see your data

• Data is separated by organisation. Signing in gives you access only to your own organisations.
• One login can belong to several organisations, and nothing passes between them. An owner can add someone only by typing their email address into an invitation. There is no list of other organisations' people to choose from. Each organisation keeps its own name for a person, its own activity, and its own audit trail. Removing someone from one organisation never affects their other organisations or their login.
• Inside an organisation, roles control what people can do. Owners manage settings and people, members work with records, and read-only members can view records but not change them.
• Support staff cannot browse your records. If you want help inside your account, you send an invitation from your organisation, and you can remove that access afterwards. Support gets only the role you choose and can never add people or download your data.
• Changing your sign-in email needs your current password. The change happens only when you open the link sent to the new address. Your current address is told first, and changing your password cancels a change you did not ask for.
• The app never says whether an email address already has an account. If someone tries to sign up with yours, you get an email saying so, and no account is created.

Outside services

A small number of outside services do part of the work, such as sending email, running bank feeds, or looking up addresses. Most are used only when you turn on the feature they serve. The service providers page lists each one, with when it is used and what it receives.

Analytics and advertising

The app uses only its own analytics, which record the screens used and any errors. Personal details are removed from error reports. There are no third-party advertising trackers, and your data is not sold or shared for marketing.

Exporting and deleting your data

Lists export to CSV and reports to PDF, and you can export your entire organisation as a single archive. You can also permanently delete your organisation and its records yourself at any time. The privacy policy lists the few items kept after deletion, such as the audit trail of who changed what.

Reporting a security issue

If you think you have found a security issue, please report it privately through the contact form, so that it can be fixed before it is discussed publicly. Every report gets a reply.