How we protect your data

You are handing us documents that belong to your clients, not to you. That is a real professional obligation, and this page is written so you can satisfy yourself about how we handle it.

Our SOC 2 Type II audit

We are now in the observation window of our SOC 2 Type II audit.

SOC 2 is an examination, by an independent CPA firm, of whether a company’s security controls are designed properly and actually work. A Type II report covers a stretch of time, called the observation window, and tests that the controls operated through all of it, not only on the day someone looked.

A SOC 2 report is not a certificate, and until ours is issued we do not describe ourselves as SOC 2 compliant. Once it is issued, a firm evaluating us can ask for a copy. It is shared under a non-disclosure agreement, because it describes our internal controls in detail.

Your documents stay private

Uploaded notices are kept in private storage with no publicly reachable address. When you open a file, we generate a link that works for a few minutes and then stops working, so a link that gets forwarded, or ends up in a screenshot, expires on its own. Everything is encrypted in transit and at rest.

Only your firm can see your notices

Your notices and clients are scoped to your firm, and every request that reads them is checked against it. Another firm cannot reach your records.

When a notice is opened or its files are downloaded, we record who did it and when, including when it is us, working in the product. If you ever need to know whether anyone at TaxNoticePilot looked at a particular client’s file in the product, that is a question we can answer rather than reassure you about. Access through our infrastructure providers’ own consoles is not recorded this way; it is limited to the two people who run TaxNoticePilot.

Nobody trains on your documents

We use a small number of established providers to read and analyze a notice, and to run the service itself. None of them use your documents to train or improve their models, and neither do we. Your clients’ letters are used to produce your analysis and nothing else, they are never made public, sold, or shared onward.

What we learn from the product is how it performs: which notice types we see, how often an analysis needs correcting, how long processing takes. Never the contents of a particular client’s letter.

We measure behaviour, never content

To find where the product is confusing or broken, we collect how people interact with it, what was clicked, where someone navigated, where they got stuck. Nothing is filmed and no screen is captured: what we collect is a stream of interaction events, not a picture of your screen.

Document contents are hidden inside your browser before anything is sent. Taxpayer names, balances and the text of a notice never leave your device as part of this, and the pages of a notice are left out of the recording entirely. What reaches us describes the shape of a page and what was clicked, not what it said.

When things are deleted

“Deleted” means deleted, on a schedule, automatically - not hidden from view forever.

• A notice or client you delete disappears from your dashboard immediately and is permanently erased, along with the uploaded files, after 30 days. The delay is your undo window.
• A firm that closes its account has its notices, clients and files permanently erased after 90 days.

One caveat we would rather state than hide: we keep encrypted backups of the database, so that a serious failure does not take your firm’s work with it. Something you delete can survive in those backups for up to 35 days after it disappears from the product, because each backup is kept for 35 days and then deleted automatically. Nobody reads them; they exist to bring the service back.

Questions

If something matters to your firm and is not covered here, ask us and we will give you a straight answer. Email b@taxnoticepilot.com and you will reach a person, not a ticket queue. Our Privacy Policy covers the formal detail.