Data Security & Compliance

Clients can activate 2FA via Google Authenticator or Authy by Twilio to add an additional layer of account security beyond passwords.

Incoming traffic is filtered and inspected for harmful patterns, ensuring only authorized and authentic access is granted to the system.

Real-time antivirus software monitors files, applications, and device behavior to detect irregularities and prevent possible attacks before they occur.

Data-in-rest, data-in-motion, and data-in-use are all encrypted. Production database access is restricted to personnel with a specific need.

One-time identity verification is required for each TaxFormHero account. This helps stop false refund claims, unauthorized form submissions, and illegal credit card use.

Pre-established fraud patterns (unique for every form type) are used to automatically identify questionable tax filings and prevent false refund claims.

Access to confidential information — by a customer or by our own staff — is written to an audit log recording who viewed which record and when. Access to confidential data inside the company is limited to a handful of named employees.

Support staff can read a customer’s records in order to help with them, but cannot send, cancel, edit or accept anything on that customer’s behalf. Reading and acting are separate permissions, enforced on the server rather than hidden in the interface.

Every signed Form W‑9 records the signer’s consent, the timestamp, the originating IP address and the device signature, and each access to a request link is recorded against that request — so a signature can be evidenced after the fact, not merely asserted.

Links sent to recipients carry a 64‑character random token, expire after 45 days by default, and are rate limited per minute, so a link cannot be guessed by brute force and does not stay live indefinitely.

Pages containing customer data are marked non-cacheable, so pressing Back after signing out does not bring a filled-in form or a list of payees back onto a shared screen.

An IRS name/TIN verification is treated as good for three years. When one lapses the payee returns to the list to be checked again, so a filing is never made on the strength of a match that is too old to mean anything.