FinishTax handles Social Security Numbers, tax documents, and signatures. Here is exactly how we protect them — down to the algorithm — so you can answer your clients with confidence.
Security isn't a page we bolted on — it's built into how FinishTax stores, transmits, and grants access to every record. Below is a plain-English account of the protections in place, and what they mean for you and your clients.
Sensitive data is encrypted before it is written to disk and again as it moves across the network.
Social Security Numbers and other sensitive fields are encrypted with authenticated AES-256-GCM before they ever touch the database.
When you link Gmail, Outlook, Google Calendar, or QuickBooks, the OAuth access and refresh tokens are encrypted at rest with the same AES-256-GCM scheme.
All traffic between your browser, our servers, and our providers is protected in transit with TLS (1.2+). Your data is never sent over an unencrypted connection.
Cloud data is stored in US-based infrastructure built on SOC 2-compliant providers, and is accessible only through your authenticated account.
Getting into an account is deliberately hard for everyone but you.
Passwords are never stored in plain text. They are hashed with bcrypt (cost factor 12), so even we cannot read them.
Turn on 2FA using any authenticator app (TOTP). You also get single-use backup codes for the day you lose your phone.
Access tokens are short-lived (15 minutes) and refreshed through an httpOnly, Secure, SameSite cookie that JavaScript can't read — limiting the blast radius if a token ever leaks.
Login and 2FA attempts are rate-limited, and abusive IP addresses can be blocked outright — so guessing attacks fizzle out fast.
Signing Form 8879 electronically has real compliance requirements. FinishTax is built to meet them.
Collect authorizing signatures on Form 8879 (and other documents) electronically, built to satisfy the IRS Pub 1345 remote-signing requirements.
Set the identity check each signature requires — from an emailed one-time code, to internal security questions built from the client's own record on file, up to a government-ID + selfie check at NIST IAL2 through our verification provider, Persona. You choose the assurance level per envelope.
For a remote Form 8879, use the Persona rung. The internal security-questions rung is a convenience check, not Pub-1345-compliant KBA — it draws on the record you typed, not third-party data, so it does not satisfy the IRS identity-verification requirement for remote 8879 signing.
Persona never hands us the photos. The government-ID image and selfie are captured and held by Persona, inside their own embedded flow. FinishTax's server only fetches and stores the inquiry result — a status and an opaque reference ID — never the images themselves. Your clients' ID photos are never stored by your firm.
We compute a SHA-256 hash of the document when it's added to an envelope, and again once it's finalised after signing. Both hashes are printed on the completion certificate as a permanent part of the record — so later alteration of the document is detectable by comparing it against the recorded hash. This happens on every completed envelope, sealed or not.
Every completed signature produces a certificate with the document details, original and signed hashes, and a full audit trail of the signing events.
The completion pipeline can apply a PAdES digital signature with an RFC-3161 trusted timestamp, and the app labels an envelope “digitally sealed” only when that really happened. We have not yet installed a production signing certificate, so envelopes complete unsealed today — protected by the SHA-256 hashes and completion certificate described above rather than by a PDF-level signature. We would rather tell you that than imply a seal you are not getting.
FinishTax uses Anthropic's Claude API for two separate things: classifying tax files, and the AI assistant you can ask questions in. They send very different amounts of data — here is exactly what triggers each, and what it does and doesn't mean for your clients' records.
Uploading a file does not, by itself, send it anywhere. A file reaches Anthropic for classification only when you click Classify on a document, run a batch classification (up to 50 files at once), or when the optional daily triage agent is turned on. Uploads sit untouched until one of those three actions happens.
For manual and batch Classify, the document itself — as an image, a PDF (capped at 20MB), or extracted text — goes to Anthropic's API so it can read the file and return a suggested name, document type, tax year, and summary. The daily triage agent works differently: it's opt-out, not opt-in (on by default, with a toggle in Settings to turn it off), and it sends only the filename, file type, and your active client list — never the document's contents — to suggest which client and pipeline stage an unrouted upload belongs to. Both are paid-plan features; the triage agent additionally requires the Small Firm plan or higher.
The assistant is a separate, paid-plan search tool you ask a question in — it never runs on its own. Each time you ask it something, FinishTax sends Anthropic a working set of your practice data as context so it can answer: client names, emails, statuses, tax years, and filing statuses; task titles, priorities, and due dates; invoice numbers, totals, amounts paid, and due dates; uploaded file names plus their previously generated AI type and summary; document-checklist items and their received/missing status; and upcoming appointment titles, times, and locations. That's a materially broader flow than file classification, it happens on every question, and nothing about it is optional once you use the assistant — there's no separate toggle to narrow what it sends. The response is returned to you and is not stored server-side as a transcript.
We're not going to make that promise on Anthropic's behalf — we don't control their model training pipeline and can't verify it from our side. What we can tell you plainly: your documents go to Anthropic's commercial API, governed by Anthropic's own commercial terms, not by anything FinishTax writes here. Read Anthropic's commercial Terms of Service for their current policy on API data and training.
The triage agent never files, renames, or reassigns anything on its own. It records a suggestion you review and accept (or ignore) from the agent activity feed; only accepting it applies the change, and it will never reassign a file that's already attached to a client.
On team plans, everyone sees exactly what they should — and every important action is recorded.
Permissions are controlled through 30 distinct permission keys across clients, documents, financials, communication, workflow, and administration — grouped into five ready-made role templates you can customize.
Client access can be scoped so a team member sees all clients, only the clients assigned to them, or none — the same applies to client messages.
A per-client activity timeline records who did what and when — document uploads, status changes, messages, and other key actions, each tied to the team member who did it.
All card payments are processed by Stripe through its hosted checkout and billing portal. Full card numbers never touch — and are never stored on — FinishTax servers.
Proven, managed building blocks — not homegrown storage.
Cloud data is stored in US-based infrastructure built on SOC 2-compliant providers. Records are held in an encrypted, SSL-connected PostgreSQL database, and uploaded documents are stored in S3-compatible object storage (Supabase Storage, with Cloudflare R2 support).
All data is encrypted in transit (TLS 1.2+) and accessible only through your authenticated account. Social Security Numbers, IRS preparer credentials (EFIN/PTIN), and connected-account tokens are additionally encrypted by FinishTax with AES-256-GCM before they reach the database; other data, including uploaded documents, is encrypted at rest by our storage providers. For the full list of the subprocessors we rely on and the data each one handles, see our Privacy Policy.
As a paid preparer, you have data-security duties under IRS Publication 4557 and the FTC Safeguards Rule. FinishTax gives you concrete tools to help satisfy them.
FinishTax helps you put the IRS Publication 4557 safeguards into practice with encrypted storage of taxpayer data, multi-factor authentication, and access controls for your staff.
FinishTax helps you meet key elements of the FTC Safeguards Rule through encryption of customer information, per-user access limits, and activity logging you can point to during a review.
Export a complete backup of your clients, tasks, invoices, files, and activity as a single JSON file at any time — a portable copy you fully control.
You can permanently delete your account from the app. It removes your database records, including client, task, and file metadata.
The questions tax professionals ask us most.
Not yet. The managed cloud providers FinishTax is built on — database, file storage, and hosting — maintain SOC 2 audits, but the FinishTax application has not completed a SOC 2 certification of its own. That is why we describe our foundation as built on SOC 2-audited providers, rather than claiming a certification of the FinishTax application itself.
SSNs and other sensitive fields are encrypted with authenticated AES-256-GCM before they are written to the database, each with a unique initialization vector and authentication tag. They are decrypted only in memory when needed, and in production the app will not start without a valid encryption key configured.
Yes. You can enable 2FA with any authenticator app that supports TOTP (such as Google Authenticator or Authy), and you receive ten single-use backup codes for account recovery. Backup codes are stored only as hashes.
FinishTax supports electronic signing of IRS Form 8879 built to satisfy the IRS Pub 1345 remote-signing requirements, with a step-up identity ladder — from emailed one-time codes up to NIST IAL2 government-ID + selfie verification through Persona, chosen per signature — plus tamper-evident SHA-256 document hashing and a completion certificate with a full audit trail. PAdES sealing is built but not yet switched on in production; see “PAdES sealing” above.
No. All card payments are handled by Stripe through its hosted checkout and billing portal. Full card numbers never touch — and are never stored on — FinishTax servers.
Yes. On team plans, access is governed by 30 permission keys and five customizable role templates, and client visibility can be scoped to all clients, only assigned clients, or none. Per-client activity is recorded in an activity timeline tied to the team member who took each action.
Yes to both. You can export a full JSON backup of your clients, tasks, invoices, files, and activity at any time, and you can permanently delete your account from within the app, which removes your database records. See our Privacy Policy for details on retention.
FinishTax doesn't train any model. Documents are sent to Anthropic's Claude API only when you trigger classification — clicking Classify, running a batch, or via the optional triage agent — never automatically on upload. Whether Anthropic itself trains on API traffic is governed by Anthropic's own commercial terms, not ours — we won't make a promise on their behalf that we can't enforce. See AI document classification above for the full breakdown of what's sent and when.
No. Identity verification (government ID + selfie) is handled entirely inside Persona's embedded flow. FinishTax's server only ever fetches and stores the verification result — the Persona inquiry ID and its pass/fail status — never the ID image or selfie itself. See “Persona never hands us the photos” in the e-signature section above.
Start free and see the protections for yourself, or dig into the pricing that fits your firm. No credit card required to begin.
Open the app →