How your data is protected

Tax App holds financial records, so it is fair to be sceptical about where that data goes and who can see it. This page describes, in plain language, how the app actually handles your information. It describes behaviour rather than internal implementation detail: we deliberately keep operational specifics private, because publishing them helps attackers more than it helps you.

Encryption everywhere

• In transit - every connection to the app and the API uses HTTPS (TLS). There is no unencrypted access.
• At rest - your records are stored in AWS data centres in Auckland, New Zealand, with storage-level encryption enabled, and are backed up automatically every day to a vault that is also in New Zealand. Inland Revenue's rules keep business records in New Zealand by default; they also allow offshore storage with IRD approval or through an IRD-approved provider, and allow offshore backups where the primary records stay here. We keep both the records and the backups in New Zealand.
• Credentials get a second layer - the small number of secrets the app stores on your behalf, such as bank feed access tokens, are additionally encrypted with AES-256-GCM before they are written to the database. Decryption keys are held in server configuration, separate from the database. These values are never shown again after you save them, never included in API responses, and never included in data exports - the app only ever displays a masked hint so you can recognise which token is saved.

Passwords and sign-in

• Passwords are encrypted in your browser before they are transmitted, on top of HTTPS, and are stored only as salted one-way hashes using Argon2id, a modern password-hashing algorithm. Nobody, including us, can read your password back.
• You can sign in with Google instead and never set a password at all.
• Sign-in and sign-up endpoints are rate-limited to slow down password guessing, and you can see and revoke your active sessions from settings at any time.

Bank feeds are read-only, and we never see your bank login

• Bank feeds connect through Akahu, a New Zealand open banking provider. You authorise your bank with Akahu directly; your internet banking username and password are never entered into Tax App and never pass through our systems.
• Tax App holds only Akahu access tokens. They can read transactions and balances for the accounts you chose; they cannot move money.
• The tokens are stored with the extra AES-256-GCM encryption layer described above and are checked with Akahu before they are ever saved.
• You stay in control: revoke access from your Akahu account at any time, or disconnect in Tax App, which deletes the stored tokens immediately. Your records and reconciliations are untouched either way.

Documents stay private

Invoices, tenancy agreements and other uploads are stored in private storage with no public web addresses. Opening a document issues a fresh link that works for a few minutes and then stops. Attachment links inside PDF reports you share expire after 14 days.

Who can see your data

• Data is separated per organisation. Signing in gives access to your organisations only.
• Within an organisation, roles control what people can do: owners manage settings and people, members work with records, and read-only members can look but not change.
• Support staff cannot browse your records. If you want help inside your account, you send an invitation from your organisation, and you can remove that access again afterwards.

No surveillance business model

The app uses first-party analytics only - which screens are used, and errors, with personal details redacted from error reports. There are no third-party advertising trackers and your data is not sold or shared for marketing.

Your data is yours

Lists export to CSV, reports to PDF, and you can export your entire organisation as a single archive. You can also permanently delete your organisation and everything in it, yourself, at any time.

Found a problem?

If you believe you have found a security issue, please tell us privately through the contact form so it can be fixed before it is discussed publicly. We take reports seriously and will respond.