Security

Vault access requires an authenticator-app code on top of your email sign-in link. This isn't a screen-level check: the database's row-level security policies refuse to return document rows or files to any session that hasn't completed MFA. A bug in the app cannot bypass it.

All traffic is TLS-encrypted; documents and database contents are encrypted at rest (AES-256 by our storage provider, Supabase). Every user's documents live under their own isolated storage prefix with per-user access policies. Downloads use short-lived signed URLs.

Every document gets a SHA-256 content fingerprint at upload — that's how duplicates are refused and how tampering would be detected. Every add, change, and delete is recorded in an append-only audit log written exclusively by database triggers; clients (including our own app code) cannot write or alter it.

No passwords to steal (one-time email links only). No third-party analytics or advertising pixels anywhere near your documents. Card payments are processed entirely by Stripe. The downloads-sorting feature runs entirely in your browser — those files never touch our servers. And your tax documents are never used for marketing or AI training.

As a service handling taxpayer financial information, we maintain a written information-security program consistent with the FTC Safeguards Rule (16 C.F.R. Part 314), with a designated security lead, and we honor federal and state breach-notification requirements, including FTC notification within 30 days where the 500-consumer threshold is met.

Email support@caughtup.tax with "SECURITY" in the subject. We commit to acknowledging reports within 3 business days, and we won't pursue good-faith researchers.