Security at TaxWallet: SOC 2, tenant scope, and what it means for your office

Tax data is some of the most sensitive PII anyone handles. Names, SSNs, bank routing numbers, dependent details — all in one record. We treat it like it deserves to be treated.

What we've locked down this quarter

• SOC 2 Type II — annual audit, no exceptions on the latest report.
• Zero plaintext PII in IndexedDB. Every cached client record is XOR-enveloped client-side before it touches local storage; decryption happens on-demand at render.
• Hard tenant scope. Every API call is bound to the calling office's BusinessUnit. A Service Bureau operator who navigates to a CustomerERO's URL gets denied at the controller — not at the UI.
• Per-user audit log. Every action (view, edit, call, SMS, export) is recorded with timestamp + IP + tier. Operators can pull their own log; admins can pull any user's.
• Twilio bring-your-own-account. Voice and SMS run through your Twilio integration, not ours. We never see the customer's account credentials in plaintext — they're sealed with a key we don't hold.

The bigger picture: an audit log isn't a feature, it's a posture. If something goes wrong, we want you (and your regulator) to be able to reconstruct exactly what happened, by whom, from which device. That's the standard, and we're holding it.