Security

Information tool, not tax advice.

At a glance

No broker credentials

We do not connect to brokers, do not ask for trading-account passwords, and do not store any credentials beyond your sign-in email.

Row Level Security

Every database query is scoped to your user identity. You cannot read another user's claims; we cannot accidentally leak across users.

Stripe-handled payments

Card numbers and bank details never touch our servers. Stripe is PCI DSS Level 1 certified and handles payment storage and processing.

Magic-link auth

No passwords to phish. Sign-in is a one-time link emailed to the address you control; sessions expire after 30 minutes of inactivity.

Infrastructure

LayerProviderCompliance posture
Frontend hostingVercelSOC 2 Type II, ISO 27001
Database & authSupabase (PostgreSQL)SOC 2 Type II, GDPR-compliant DPA
PaymentsStripePCI DSS Level 1, SOC 1 / 2
Error monitoringSentryPII scrubbed at the SDK boundary

Reporting a vulnerability

We respond to good-faith security reports promptly. Please email security@taxreclaim.eu; do not exploit, exfiltrate, or destroy data while testing.

Row-Level Security (RLS)

Every database row is scoped to its owner. Each query is filtered by auth.uid() at the database level — application code cannot bypass it. A misconfigured query that asks for "all rows in claims" returns only the rows belonging to the signed-in user. This is enforced by PostgreSQL, not by application logic.

Broker credentials

Tax Return Buddy stores no broker credentials and connects to no broker APIs. Users enter dividend and interest amounts manually or paste them from broker statements. No screen-scraping, no API tokens, no OAuth connections to brokerage accounts.

GDPR posture

Tax Return Buddy is operated for the EU market. Users have, at any time:

  • Export: a JSON download of profile data and saved claims, available from Billing settings. See Privacy for the data categories covered.

  • Deletion: account deletion from Settings begins a 14-day grace period during which the account can be restored from the confirmation link. After 14 days, all rows linked to the account are removed and the Supabase auth identity is hard-deleted.

  • Stripe subscription: deletion sets the Stripe subscription to cancel at the end of the current billing period (aligns with EU 14-day right-of-withdrawal already in place since Phase 02).

Hosting is on Vercel (frontend) and on a backend instance behind Cloudflare. Sensitive data is stored in Supabase EU regions.