Information Security Policy
How Deduckt protects the tax and financial information you trust us with. This is a living policy; we review it regularly and update it as we grow.
Version 1.0 · Owner: Security Lead · Effective: June 14, 2026 · Review cadence: at least annually.
1. Purpose and scope
This policy establishes how Deduckt safeguards the confidentiality, integrity, and availability of customer data and company systems. It applies to all employees, contractors, and systems that store, process, or transmit Deduckt data, including the application, the tax engine, and third-party services such as Plaid and our model providers.
2. Roles and responsibilities
A designated security owner is accountable for this program. All personnel are responsible for following this policy, completing security training, and reporting suspected incidents. Access to production systems and customer data is limited to those with a specific business need.
3. Risk management
We identify, assess, and treat security risks on a recurring basis and before material changes to the product. Findings are tracked to remediation, and residual risk is reviewed by the security owner.
4. Access control and authentication
Access follows least privilege and is granted by role. Customer accounts authenticate with a password (hashed with a strong key-derivation function) and server-side sessions, and can enable multi-factor authentication using a one-time code sent to their email or phone. Administrative and production access requires strong authentication and is logged and reviewed; credentials are never shared.
5. Data classification and handling
Data is classified into tiers. Tier 1 (Social Security numbers, financial account numbers, full tax documents) stays inside our trust boundary and is never sent to third-party models. Tier 2 (income figures, computed findings) is encrypted and minimized. Tier 3 (email, settings) receives standard protection. Handling rules follow the classification.
6. Encryption and key management
Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256. Highly sensitive secrets, such as the Plaid access token, receive additional application-level (field) encryption. Keys are held in a managed key service with restricted, logged access and scheduled rotation; secrets are never stored in source code.
7. Acceptable use
Company systems and data are used only for legitimate business purposes. Personnel must protect credentials, use approved tools, and must not exfiltrate, misuse, or expose customer data. Violations may result in revoked access and disciplinary action.
8. Secure development and change management
Changes are version-controlled, tested, and reviewed before release. Our deterministic tax engine is gated behind an automated regression test suite, and security-relevant changes receive additional review. We separate the engine (which performs all tax math) from the presentation and model layers as a core control.
9. Third-party and vendor risk management
Every vendor that can access customer data must sign a data processing agreement, demonstrate an adequate security posture (such as SOC 2), commit to defined or zero data retention, and contractually agree not to train models on our data. We maintain a current list of subprocessors and disclose it in our privacy policy.
10. Logging and monitoring
Security-relevant events, including access to sensitive data and administrative actions, are logged. Logs are protected from tampering and reviewed for anomalies. We monitor for errors and unusual activity across our services.
11. Incident response and breach notification
We maintain an incident response process to detect, contain, investigate, and remediate security events. In the event of a data breach, we notify affected users and regulators as required by applicable law and within the timeframes those laws prescribe.
12. Business continuity and disaster recovery
Customer data is backed up on an encrypted, access-controlled basis, and restores are tested. We design our infrastructure to recover from outages and to meet defined recovery objectives.
13. Data retention and disposal
We retain personal and financial data only as long as needed to provide the service or as required by law, then securely delete it. Users may delete their account and associated data at any time from their settings, after which we remove it from active systems within a defined window, subject to legal retention requirements.
14. Personnel security
Access is provisioned on hire by role and promptly revoked on departure. Personnel complete security and privacy training and acknowledge this policy. Confidentiality obligations apply to all who handle customer data.
15. Physical and infrastructure security
We rely on reputable cloud providers whose data centers maintain physical and environmental controls. Company devices are protected with encryption, screen locks, and current software. Remote access to systems requires strong authentication.
16. Compliance and regulatory
We handle tax return information in accordance with IRC §7216, financial data consistent with the GLBA Safeguards Rule, and California consumer data under the CCPA as amended by the CPRA. We are pursuing SOC 2 readiness. This policy supports those obligations and is not a substitute for legal advice.
17. Policy governance and review
This policy is owned by the security lead, reviewed at least annually and after material changes, and approved by company leadership. Questions or security reports can be sent to security@deduckt.ai.
This policy describes Deduckt's security program and is reviewed at least annually and after material changes. We are pursuing SOC 2 examination; references to that work describe an in-progress effort, not a completed certification. This page is provided for transparency and is not legal advice.