What privacy-first actually means here
Most vendors answer the data question with a certification. We think the better answer is an architecture where the data worth stealing never persists on our side at all.
Updated : An earlier version of this post said Taxably Connect uploads each document to us to be read, and that we delete it afterwards. The section on what crosses the wire now says what happens: a document's pages go from the firm's workstation to the reading provider, and our servers are not on that path. It also describes, separately, the overnight way of reading that holds a run's pages in storage Taxably administers, which is not switched on in the version a firm installs.
Updated : The September 23 correction described the reading provider's terms as not letting it keep the pages, and a later sentence in the post claimed the same. Neither is established. The provider is not permitted to train on the pages, and under its standard terms it can keep content it flags for abuse monitoring for up to 90 days unless an applicable agreement applies. Both passages now say what is established.
Updated : The September 23 correction said a document's pages go to the reading provider inside the United States. That is not established for the versions of Taxably Connect firms have used: versions 3.0.0 through 3.3.6 send the pages through the provider's global location, which serves a request from wherever there is capacity and does not guarantee that it is processed in the United States, and the provider does not report where each request was processed. The post now says so, and says that from version 3.3.7 Taxably Connect sends the pages only to the provider's United States locations.
Updated : Every firm now runs a version of Taxably Connect that sends pages only to the provider's United States locations, so the section on what crosses the wire describes that and no longer describes earlier versions. The October 13 note above records how earlier versions sent them.
Updated : An earlier version of this post said the audit timeline was published on our Trust Center. No auditor is engaged and no timeline is published; the Trust Center says Taxably holds no SOC 2 report.
Every vendor pitch to a tax firm eventually reaches the same slide: SOC 2, encryption at rest, encryption in transit. Those controls matter and we are building toward the same attestations. But they all share an assumption worth saying out loud: the vendor holds your clients' documents, and the controls exist to guard the pile it holds.
We made a different bet. The documents a tax firm handles are among the most identity-dense in commerce: names, addresses, Social Security Numbers, account numbers, income. The cheapest breach to survive is the one where there is nothing to take. So Taxably is built so that client identities never persist on our servers in the first place.
What actually crosses the wire
Taxably Connect runs on one Windows workstation inside the firm. To be read, each document's pages go from that workstation straight to the reading provider named on our subprocessor list. Taxably Connect sends them only to the provider's United States locations, and refuses the provider's global location, which does not guarantee that a request is processed in the United States. The provider does not report where each request is processed. That provider is not permitted to train on them. Under its standard terms it can keep content it flags for abuse monitoring for up to 90 days, unless an applicable agreement applies. Our servers are not on that path. What they keep is a record of what was read, and it carries no client identity: names and addresses are replaced with placeholders before the record is stored, and SSNs and account numbers are left out of it altogether. What we keep is structure: a placeholder, a form type, a section, an amount.
The map between a placeholder and a real person lives on the firm's workstation, and only there. We never see it, we cannot reconstruct it, and that is not a policy promise, it is how the thing is built. If the records on our servers were breached tomorrow, the attacker would hold anonymous placeholders and box totals, not a client list.
One way of reading works differently, and it is not switched on in the version of Taxably Connect a firm installs: an optional bulk mode that reads many documents in one run. Where it is switched on, that run's pages wait in a separate storage location in the United States that Taxably administers, only for the length of that run, and are deleted when it finishes. They are the pages as they arrived, not the placeholder records described above. Section 3.2 of the Data Processing Addendum is the full statement.
Why we phrase it carefully
You will notice we never write that data never leaves your machine. It would be a stronger sentence and it would be false: documents are read in the cloud, because the document-reading step runs there. The honest claim is narrower and, we think, more useful: client identities never persist on our servers, a document's pages go to the reading provider and not to us, and only your workstation can put a name back on a record.
The same honesty applies to compliance. We hold no SOC 2 report and have not engaged an auditor, and our Trust Center says so rather than advance-claiming a certification we do not yet hold. A firm's WISP and the FTC Safeguards Rule both reward minimizing what a vendor receives; receiving placeholders instead of identities is the strongest minimization we know how to build.
See the prep sheet for yourself
How it works shows what a real prep sheet holds, built from a sample client folder.
See how it works