Legal and trust
Security & Compliance Overview
- Last Updated:
Taxably, Inc. provides Taxably Connect, software that reads the tax documents your firm connects and produces prep sheets for your review. The firm's computer holds its working records and outputs. Hosted services handle account operations and support document reading. This overview helps your firm evaluate the service without publishing sensitive operating details.
1. Current assurance status
| Material | Current status |
|---|---|
| Written Information Security Plan | Adopted October 15, 2026, with a named owner. Known gaps remain open, each with a remediation date; adoption does not mean every control is complete. A public summary is available. |
| SOC 2 Type II report | No issued report is available. No bridge letter is offered in place of a completed examination. |
| ISO/IEC 27001 certification | Taxably does not claim certification. |
| Independent penetration test summary | No completed independent report is available in the current assurance record. A testing requirement is not evidence that a test has occurred. |
| Hosted backup configuration | Encryption at rest, seven-day automated backup retention, and a point-in-time recovery window verified as of September 17, 2026. This is not a recovery-test attestation. |
Certificates or reports held by a cloud provider do not certify Taxably or all of its product controls. This overview is not an audit opinion, a guarantee against breaches, or a statement that using Taxably makes your firm compliant.
2. Data handling
Connect works with folders selected by the firm. Source documents and generated workpapers remain under the firm's control. Document content is sent to the disclosed AI reading provider, and file or folder names may also be processed to understand the connected filing structure. Where bulk reading is enabled, temporary processing copies can be held in United States storage administered by Taxably.
Taxably does not use customer tax content to train or fine-tune shared models or authorize its reading provider to do so. Provider retention and optional assistant connections require separate consideration. Read the AI & Model Training Policy and Subprocessor List for those boundaries.
Hosted account, billing, device, and operational records are retained to operate the service. Client identifiers reduce the need to transmit names in operational reporting; they are not a guarantee of anonymity. The Privacy Policy describes the categories and purposes of information use.
3. Access and protection
The service uses encrypted network connections, authenticated accounts, paired-device authorization, firm-scoped access checks, and restrictions on internal administrative access. Hosted records are encrypted at rest. Account security and access choices should follow your firm's own requirements, including multi-factor authentication where required.
Connect keeps its working records on the firm's computer as ordinary files and does not lock them to the computer. The records, exported workpapers, and other files therefore need the firm's own full-disk encryption, Windows account controls, access controls, and backups.
Security-relevant and operational events support investigation and troubleshooting. These controls are specific product safeguards, not a representation that every administrative requirement or independent assessment is complete.
4. Security program and continuity
The WISP summary describes accountability, administrative, technical, and physical safeguards, and the program's adoption status. The Business Continuity & Disaster Recovery Policy explains hosted backups, local recovery responsibilities, and the limits of recovery claims.
The Data Processing Addendum sets the applicable processing and breach-notification obligations. The Service Level Agreement addresses availability and credits. These documents serve different purposes and should be reviewed together.
5. Request security materials
Email legal@taxably.ai from your business address with your firm's name, your role, the materials or questionnaire requested, and any review deadline. Do not include taxpayer documents, tax IDs, passwords, or payment-card details.
Taxably will confirm the requester's identity, the purpose of the review, and which materials are available. Sensitive materials may require confidentiality terms and may be redacted to protect customers and system security. Available materials can include program documentation and control explanations; requesting a SOC 2 report or penetration test summary does not imply that such a report exists. If a requested item is unavailable, the response should identify it as unavailable.
Internal access details, recovery commands, credentials, and vulnerability findings are not published on this page. There is no automatic report download or promise of a certification date.
6. Report a security concern
Send suspected vulnerabilities or unauthorized access reports to security@taxably.ai. Include a description, the affected product or page, and a safe way to reach you. Share sensitive evidence only after agreeing on an appropriate channel.
For setup, billing, and prep-sheet questions, use Help and support. For all published agreements and policies, visit Legal documents.