TaxWise
Start filing
Security at TaxWise

Bank-grade where it counts. Boringly specific everywhere else.

Tax data is among the most sensitive financial information a person produces. Here is exactly how we protect it.

Where we stand

Certifications, audits, and what they mean.

ISO/IEC 27001:2022
Planned

Planned · On our security roadmap for 2027

SOC 2 Type II
Planned

Planned · On our security roadmap for 2027

PDPA (Sri Lanka)
Live

Built to comply · Personal Data Protection Act No. 9 of 2022

Data residency
Live

All personal data hosted in AWS Singapore (ap-southeast-1), across multiple availability zones

Posture

Concrete controls. Not adjectives.

Data at rest
  • AES-256-GCM envelope encryption on every PII column.
  • Customer-specific Data Encryption Keys (DEKs), rotated every 90 days.
  • Key-Encryption-Keys (KEKs) held in AWS KMS Singapore, never on application servers.
Data in transit
  • TLS 1.3 minimum, with HSTS preload across every TaxWise subdomain.
  • Mutual TLS between internal services. No internal plaintext.
Authentication
  • Argon2id password hashing (memory cost 64 MiB, iterations 3, parallelism 4).
  • TOTP-based 2FA available on every account; required for Practitioner accounts.
  • WebAuthn passkeys supported. Session refresh tokens rotated on every use.
Infrastructure
  • Private VPCs in AWS Singapore (ap-southeast-1), spread across multiple availability zones for failover.
  • All compute behind a private subnet. Public surface is a single CDN edge.
  • Every change goes through pull request, automated tests, and code-owner review.
Monitoring & response
  • Security disclosure: security@taxwise.lk — 24-hour acknowledgement SLA.
What we don't do
  • We do not sell, rent, or share personal data with any third party for marketing.
  • We do not use customer data to train external AI models.
  • We do not retain return data beyond the seven-year IRD requirement plus a 30-day audit window.
Responsible disclosure

If you find a vulnerability, please tell us.

We acknowledge every report within 24 hours and triage within 5 business days.

Email: security@taxwise.lk
Acknowledgement SLA: 24 hours. Triage SLA: 5 business days.