Trust · 3 min read
Security & privacy
How we handle authentication, data, and secrets.
Authentication
TaxSailor supports email/password and Google OAuth. Sessions are HTTP-only, rotated on refresh, and revocable from the account page. There is no anonymous sign-up.
Data at rest
Simulation inputs and outputs are stored per-account and scoped by row-level security. Only you and the accounts you explicitly share with can read your runs.
Data in transit
All traffic is TLS 1.2+. The Assistant proxy strips headers before forwarding to the model provider.
Secrets
API keys and service credentials are stored server-side only. The client never sees a provider token. Webhook endpoints verify signatures with constant-time comparison before processing any payload.
Responsible disclosure
Found a vulnerability? Write to security@taxsailor.com - we respond within one business day.