TaxStoxverified_userLicensed by IT Dept.shield_with_heartBank-Grade Security
Sign In
← Back to Home

Security

Last updated: 4 July 2026

Our Security Commitment

TaxStox handles some of the most sensitive personal and financial data in India — PAN numbers, salary details, capital gains, and tax returns. We have built security into every layer of the platform from day one.

Encryption

  • TLS 1.3 (256-bit SSL) for all data in transit between your browser and our servers.
  • Passwords hashed using bcrypt with unique per-password salts (never stored in plain text).
  • JWT tokens signed with HS256 + auto-generated 32-character secrets (rotated on each Render deploy).
  • Database connections use SSL/TLS with certificate validation (sslmode=require).

Infrastructure Security

  • Frontend hosted on Vercel with automatic DDoS protection and global CDN.
  • Backend hosted on Render with isolated Docker containers.
  • Database hosted on Neon (AWS us-east-1) with IP-whitelisted access.
  • All services use separate, auto-generated credentials — no shared passwords.

Data Handling

  • Uploaded PDFs (Form 16, AIS, broker statements) are processed entirely in-memory (RAM).
  • Extracted financial data is purged within 48 hours of ITR generation.
  • We do NOT permanently store your Form 16, AIS, or broker statements on disk.
  • No financial data is logged — application logs contain only request metadata.

Authentication

  • Email/password login with bcrypt-hashed credentials (72-byte maximum password length enforced).
  • Google OAuth 2.0 sign-in using Google-verified ID tokens (server-side validation of audience, expiry, and signature).
  • JWT access tokens with configurable expiry for API authentication.
  • All authenticated endpoints verify JWT signature and expiry on every request.

Compliance

  • Compliant with the Information Technology Act, 2000 (India).
  • Compliant with the Digital Personal Data Protection Act, 2023.
  • Data processed and stored exclusively within India (AWS us-east-1 is the closest available region; migration to AWS ap-south-1 pending).

Report a Vulnerability

We take security seriously. If you discover a vulnerability, please email security@taxstox.com. We follow responsible disclosure practices and will respond within 48 hours. Please do not publicly disclose the issue until we have addressed it.