Skip to content
Security at TaxWise

Bank-grade where it counts. Boringly specific everywhere else.

Tax data is some of the most sensitive financial information you have: your salary, your TIN, your bank statements. Here is exactly how we protect it, and what we still haven’t done.

  • AES-256 encrypted
  • Never sold
  • Never used to train AI
  • Yours to export or delete
Where we stand

Certifications, and what they really mean today.

Two are live. Two are planned, and we label them that way until an auditor has signed something.

Planned

ISO/IEC 27001:2022

Information security management. On our security roadmap; no audit has started yet.

Planned

SOC 2 Type II

Independent audit of our controls over time. On our security roadmap.

Live

PDPA (Sri Lanka)

Built to comply with the Personal Data Protection Act No. 9 of 2022.

Live

Data residency

All personal data hosted in AWS Singapore (ap-southeast-1), across multiple availability zones.

Controls

Concrete controls. Not adjectives.

Data at rest

  • AES-256-GCM envelope encryption on every column that holds personal data.
  • Customer-specific data encryption keys, rotated every 90 days.
  • Key-encryption keys held in AWS KMS Singapore, never on application servers.

Data in transit

  • TLS 1.3 minimum, with HSTS preload on every TaxWise subdomain.
  • Mutual TLS between internal services. No plaintext inside the network either.

Authentication

  • Sign-in runs on Supabase Auth. Passwords are stored only as salted hashes.
  • Short-lived access tokens; refresh tokens rotate every time they are used.
  • Two-step sign-in and passkeys: coming next. We’ll say so here when they ship.

Infrastructure

  • Private VPCs in AWS Singapore (ap-southeast-1), spread across availability zones for failover.
  • All compute sits in private subnets. The only public surface is a CDN edge.
  • Every change goes through a pull request, automated tests and code-owner review.

Monitoring & response

  • Security reports to security@taxwise.lk are acknowledged within 24 hours.
  • Reports are triaged within 5 business days, and we tell you what we’re doing about yours.

What we don’t do

  • We don’t sell, rent or share personal data with anyone for marketing.
  • We don’t use your data to train AI models, ours or anyone else’s.
  • We don’t keep return data past the seven-year statutory period plus a 30-day deletion window.
  • We don’t send anything to the IRD. You submit your own return.
The journey of your bank statement

Five stops, from your Downloads folder to gone.

Tap a stop to see what happens there.

01 · Upload

You add a statement

You drop in a PDF from your bank. It travels over TLS 1.3, straight to our servers in AWS Singapore. Nothing else on your phone or laptop is touched.

Responsible disclosure

Found a vulnerability? Please tell us.

We acknowledge every report within 24 hours and triage within 5 business days. Please give us a fair chance to fix it before you talk about it publicly, and don’t access data that isn’t yours.

security@taxwise.lk

What happens after you write

  1. 24 hWe confirm we’ve received your report.
  2. 5 daysTriage: we tell you how serious we think it is and what we’ll do.
  3. FixedWe tell you when the fix is live.

Helpful to include: the steps to reproduce, the URL or screen involved, and how to reach you.

Get filing-ready for 2025/2026.

Your first estimate in about a minute. Free for salary and bank interest. No card needed.

Start my return

Return for Y/A 2025/2026 due 30 November 2026