Security
Last updated November 12, 2026
Tax documents are some of the most sensitive files you have. This is what we do with them today.
We never store the Social Security number you type
You enter it each time you download a PDF. It goes into that PDF and isn't saved. We don't read it off your W-2s either. If a file you upload shows it, that file is kept encrypted like the rest.
Your data is encrypted with your own key
Your documents, what we read from them and your edits are encrypted (AES-256) with a key unique to your account. Everything travels over HTTPS.
You sign in with a passkey
An emailed code, then a passkey on your device: your face, fingerprint or device PIN. There's no password to steal. We email you whenever a passkey is added or a recovery code is used.
Documents sit in private, encrypted storage
Files are encrypted before they're stored, in private storage in the United States with all public access blocked.
You can delete everything
Choose "Delete account" on your Account page. We destroy your encryption key first, so copies in our backups can't be read, then delete your files and records. Your email address can remain in backups for up to 31 days.
AI reads a document only if you sign for it
We read most PDFs on our own servers. AI is only for photos, scans and PDFs our software can't read yet (up to 10 pages). Those go to our AI provider, Anthropic, only if you sign a consent for that tax year. Without it, nothing is sent: you type in what the document shows, or wait for us to support it. You can withdraw consent on your Account page.
An AI assistant gets limited access, only if you approve it
Connecting one takes your passkey and a signed consent. It gets its own token that works only for the assistant's actions, expires in 7 days and can be revoked on Account. It can't see your Social Security number, bank details or document files, and can't sign, pay or file. We email you when one connects.
What to know
- Our servers hold the keys, because they have to read your documents to prepare your return. This isn't end-to-end encryption.
- Your email address and basic records, like file sizes and dates, aren't encrypted this way.
- An administrator can open an account to fix a problem. Those sessions end within an hour and are logged.
- If you ask for CPA review, the CPA receives your return and documents, but not your Social Security number from us.
- We haven't had an outside security audit, and we don't hold a security certification.
The full details are in our Privacy Policy. Questions: privacy@tidetax.com.