TaxDome Trust Center

Explore our resources to learn how we safeguard client data. We prioritize security by implementing industry best practices and continuously monitoring our systems to meet all compliance standards.

How TaxDome approaches security

Privacy

We prioritize your privacy by implementing robust security measures to protect your data. See how we manage your data and customer information in our privacy policy.

Security

We ensure strong security processes in both our product and working environment, aligning people, processes, and technology.

Compliance

We’re compliant with industry-recognized security standards and adhere to the latest requirements. Our compliance program is verified by reliable auditors.

Status

We provide real-time updates on TaxDome’s platform uptime as part of our commitment to transparency and proactive system monitoring. Stay informed by visiting our status page.

A partner you can trust

Your trust is our greatest asset, and safeguarding your data is at the core of everything we do. Security isn’t just a feature — it’s the foundation on which everything else is built.

Victor Radzinsky, CO-FOUNDER AND CEO

COMPLIANCE

Certifications and attestations

TaxDome complies with global privacy laws and security standards, implementing measures to help you fulfill your compliance obligations.

SOC 2 Type II

A critical security framework for service organizations that handle sensitive data. The framework focuses on managing controls related to security, availability, and confidentiality. The attestation should be renewed annually.

GDPR

The General Data Protection Regulation (GDPR) sets strict rules to protect the personal data of EU residents. It ensures that data is handled securely and transparently. Organizations that fail to comply can face significant fines, making GDPR a global benchmark for data privacy.

eIDAS

The Electronic Identification, Authentication and Trust Services regulation (eIDAS) is an EU law that standardizes electronic identification and trust services, making digital transactions secure and legally binding. It ensures that electronic signatures, seals, and timestamps are recognized across all EU member states.

PCI DSS SAQ A

PCI DSS is the security standard for organizations that accept card payments. TaxDome completes SAQ A, the self-assessment for merchants that outsource payment processing to PCI DSS-compliant providers, so card data is handled by those providers and not stored by TaxDome.

Gramm-Leach-Bliley Act

The GLBA requires financial institutions to protect consumer data and be transparent about their information-sharing practices. It mandates the implementation of security protocols to safeguard personal data and the disclosure of data-sharing policies to customers.

See how we implement security at every level

Join a live demo to discover TaxDome’s key security measures in our product and processes.

Request demo

Policies

Privacy policy

TaxDome AI (zero retention)

Cookie policy

Security policy

Gramm-Leach-Bliley Compliance (GLBA)

General Data Protection Regulation (GDPR)

Marketplace

Building robust and proactive security measures

Security measure	Overview
Network security	TaxDome leverages AWS and Cloudflare network security features, such as VPCs, security groups, web application firewalls, and DDoS protection, to secure the platform at the network edge.
Endpoint security	TaxDome enforces encryption on employee devices, requires multi-factor authentication for access, and mandates automatic device locking when idle.
Product security features	TaxDome prioritizes product security by using secure coding practices to prevent vulnerabilities and input validation to block malicious data entry. Multi-factor authentication (MFA) and role-based access controls (RBAC) ensure that only authorized users can access the data they need.
Access control	TaxDome safeguards data with granular access controls. Its role-based access control (RBAC) system limits access based on user roles and permissions. This 'least privilege' approach ensures users only see the data necessary for their job functions, reducing the risk of insider threats.
Application security	TaxDome follows secure coding practices, regularly scans its application for vulnerabilities, and stays updated on the latest web application threats. TaxDome checks for common web application vulnerabilities, such as SQL injection or cross-site scripting (XSS), and fixes the issues it finds.
Risk management	TaxDome partnered with Chubb to strengthen its risk management strategy through DigiTech® Enterprise Risk Management insurance. This plan offers comprehensive coverage against cyber threats, data breaches, and business interruptions, helping ensure operational security and continuity.
Data protection	TaxDome uses TLS 1.2 or higher for encrypting data in transit and AES-256 encryption for data at rest. Encryption keys are rotated regularly to ensure security.
Security awareness training	TaxDome requires all employees to complete annual security training to identify and report security issues, understand evolving threats, and follow secure practices. The training covers secure coding, data protection, and threat awareness.
AI and connected tools	Depending on the feature, your request may be processed by a vetted AI provider solely to generate the result, under contract terms that prohibit training on your data. Your data is never sold or used to train AI models. If you connect your own AI tool through MCP or our API, you share data with that tool by choice.

TaxDome has a SOC 2 Type II attestation

TaxDome’s SOC 2 Type II attestation is more than just a badge of honor; it’s a promise to our clients that we prioritize their security above all else. Contact us to request our official SOC 2 Type II report.

TaxDome guarantees effective response and monitoring measures

TaxDome keeps your data safe with continuous monitoring, strong security checks, ransomware protection, and secure encryption using AWS.

Monitoring

TaxDome continuously monitors its platform’s infrastructure, services, and events for suspicious activity. TaxDome uses a combination of internal and external tools and services for monitoring and has procedures for escalation and resolution.
Vulnerability management and independent testing

TaxDome employs various tools and processes to identify and mitigate vulnerabilities, including code reviews, vulnerability scanning, automated patching, and independent security audits.
Vendor security review

TaxDome has a process to evaluate the security posture and compliance of its vendors, including AI providers, before engaging them.
Defense against ransomware attacks

For ransomware protection, TaxDome employs data backups, user education on phishing attacks, endpoint security measures, encryption of data in transit and at rest to prevent unauthorized access, and key rotation. TaxDome offers a more secure data storage solution compared to local devices.
Cryptography and data protection

TaxDome uses TLS 1.2 or higher for data in transit, encrypts data at rest, and regularly rotates encryption keys.
Cloud security

TaxDome leverages the secure Amazon Web Services (AWS) cloud to store and protect your data. Under AWS’s shared responsibility model, AWS ensures a secure infrastructure, while TaxDome uses services such as IAM for access control, KMS for data encryption, and CloudTrail and Config for continuous monitoring.

Discover how to protect your firm from security threats – download our ebook

Learn where firms like yours are most vulnerable — and how to stay protected. Download our free security guide tailored for accounting, bookkeeping, and tax prep professionals.

How we protect user data

Your data security is our priority. We constantly monitor all security notifications, and our engineers work together with the product teams to address all issues immediately. TaxDome implements a multi-layered approach to keep your information safe. That includes AI: your data is never used to train AI models, and AI providers process it only to generate the output you asked for.

TLS 1.2+ encryption protects your data

All data communication between you and TaxDome is encrypted using industry-standard TLS 1.2+ encryption.
Secure storage in AWS data centers

We store your data in Amazon Web Services (AWS) data centers, which are recognized for their robust security measures and physical access controls.
Strict access for authorized users

Only authorized personnel have access to your data. Rigorous access controls and permission levels further safeguard your information.
SOC 2 Type II attested security controls

TaxDome maintains SOC 2 Type II attestation, demonstrating adherence to rigorous security standards set by independent auditors. This attestation verifies the platform’s security controls and data management practices.

How does TaxDome comply with data privacy laws?

At TaxDome, we prioritize data privacy and adhere to global standards to ensure your data — and your clients’ data — stays protected.

To provide a secure, compliant basis for data transfers, we incorporate the EU’s Standard Contractual Clauses (SCCs) in our Data Processing Addendum, ensuring that all data handling aligns with European data privacy laws.

TaxDome stores data in DPA-compliant vendors and helps customers meet the data subject rights requirements of GDPR. In compliance with GDPR requirements, we have appointed Rickert Rechtsanwaltsgesellschaft mbH as our representative in the EU for matters concerning data protection. Check out our GDPR policy for more information.

Your trust and data security are paramount to us, and we remain fully committed to compliance with the highest privacy standards.

Who are TaxDome’s sub-processors?

TaxDome uses third-party services (e.g., for cloud hosting, email and calendar integration, SMS, identity verification, customer support, and AI features) that may process personal data, depending on the features you use and the information provided by customers. These services are classified as “sub-processors.”

Each sub-processor is bound by a written data processing agreement that includes confidentiality, security, and data protection obligations.

For AI features, your request may be processed by one of TaxDome’s vetted AI providers solely to generate that feature’s output, under contract terms that prohibit using your data to train their models.

We’re keeping this process transparent — you can access the list of our sub-processors here.

Has TaxDome completed a third-party security assessment?

TaxDome completed the CASA Tier 2 application security assessment required for Google OAuth verification. It included an independent scan by an authorized assessment lab and a security questionnaire.

Articles

Learn more about our security approach.

TaxDome’s continued investment in stability

In this article, we outline some of our team’s crucial infrastructure improvements that have and will continue to lead to performance improvements in your workspace in the coming years.

July 7, 2023 3 min read

TaxDome’s SOC 2 Type II compliance commitment

We’re happy to announce that TaxDome has attained SOC 2 Type II attestation: a testament to our commitment to providing you and your clients with multi-layered, industry-leading security and privacy.

April 11, 2024 2 min read

TaxDome completes SOC 2 Type I Audit Examination

TaxDome, a provider of integrated software solutions for tax professionals and accountants, has completed a System and Organization Controls (SOC) 2 Type I attestation for Security

April 15, 2024 2 min read

Frequently asked questions

Is my client data secure when I use AI in TaxDome?

Yes. Depending on the feature, your request may be processed by one of TaxDome’s vetted AI providers solely to generate that feature’s output, under contract terms that prohibit using your data to train their models. These providers are listed on our sub-processor page. Your stored TaxDome data stays on the AWS infrastructure that already protects it, with the same encryption, SOC 2 Type II attestation, and independent security audits.

Is my data used to train AI models?

No. Your data is never sold, and no AI model, whether TaxDome’s or a provider’s, is trained on it. Our AI providers process feature content only to generate the output you asked for, under contract terms that prohibit training. If you connect your own AI tool through MCP or our API, you share data with that tool by choice, and TaxDome stays your system of record.

Can I connect my own AI assistant to TaxDome?

Yes, with the TaxDome AI add-on. Our open Model Context Protocol (MCP) connector lets your AI tool read and act on TaxDome data directly, without exporting files or duplicating data. You can also build your own integrations with our public API.

Can you share your organization’s security policies?

Please see TaxDome’s Security Policy and Privacy Policy.

Do you have a formal incident response policy?

Yes, TaxDome has multiple incident response plans in place, including:

– Security incident response policy

– Production incident protocol

– Non-technical team critical incident protocol

– Emergency bug fix protocol

Do you have SOC 2 attestation?

Yes, TaxDome has attained SOC 2 Type II attestation: a testament to our commitment to providing you and your clients with multi-layered, industry-leading security and privacy.

Is TaxDome PCI DSS-compliant?

Yes. TaxDome completes the PCI DSS Questionnaire A (SAQ A) and holds a SOC 2 Type II attestation. With the TaxDome Drive, your data is kept safe thanks to multiple layers of digital security such as encryption, strong passwords, and multi-factor authentication.

Is TaxDome Gramm-Leach-Bliley Act (GLBA) compliant?

Yes, TaxDome is compliant with the Gramm-Leach-Bliley Act (GLBA). The GLBA mandates that financial institutions protect the privacy of consumers’ personal information. At TaxDome, we adhere to stringent data protection measures and implement robust security protocols to ensure compliance with GLBA requirements. This commitment ensures that the sensitive information of our clients and their customers is safeguarded against unauthorized access and potential breaches.

Get help on Trust Center usage

If you need help using the Trust Center or want to learn more about our security measures, please contact our Support Team.