Data Security and Compliance

Introduction

Tax Form Hero currently supports more than 15 Forms in the platform. More forms will be added in the future. By using our user-friendly dashboard and completing forms or importing bulk Excel and CSV File, you can E-file in minutes. You can also monitor the status of your filings from our dashboard. Copies for recipients are available for free download in PDF format.

Our staff is aware of how critical it is to protect our clients' data. We have maintained many levels of security measures and employed various approaches to guarantee the safety of all of our clients' data.

This is a summary of the security guidelines and procedures that Tax Form Hero has put in place to guarantee the safety of our clients' information.

Observance

Compliance with HIPAA
  • A federal statute in the United States called the Health Insurance Portability and Accountability Act (HIPAA) establishes guidelines for safeguarding Protected Health Information (PHI).
  • PHI is extremely sensitive data that needs to be protected with robust security measures since it contains any information that could be used to identify a patient or their medical condition.
  • Tax Form Hero has put in place all the necessary security measures to abide by HIPAA rules as a service provider handling PHI. These precautions include administrative, technical, and physical steps to guarantee PHI's availability, confidentiality, and integrity.
Compliance with PCI DSS

A collection of guidelines known as the Payment Card Industry Data Security Standard (PCI DSS) was created to guarantee secure credit, debit, and cash card payments and stop cardholders' confidential data from being misused.

Every payment processing instrument that Tax Form Hero uses complies with PCI-compliance standards for securely transferring and encrypting credit card information.

Measures for Cybersecurity

Authentication using two factors (2FA)

Clients of Tax Form Hero have the option to activate 2-FA Authentication and strengthen account security. Google Authenticator, AUTH by Twilio.

A firewall

In order to ensure that only authorized and authentic access is granted, we put in place a Web Application Firewall that filters incoming traffic and examines requests for harmful patterns.

Antivirus software

Our system is safeguarded by antivirus software, which keeps an eye on files, apps, and device behavior to spot irregularities and stop possible attacks.

Security of PII Data

To guarantee the protection of our clients' personal information (such as Social protection numbers, email addresses, phone numbers, etc.), we adhere to all standard PII data security requirements.

Data-in-Rest, Data-in-Motion, and Data-in-Use encryption

Only individuals with a specific need to access the production data are allowed access to the production databases. In order to guard against previously unheard-of security events, we also fragment data and regularly execute data backups.

Comprehensive Security for Defense

We use layered security that integrates various tiers of security controls and methods, also known as defense-in-depth security architecture.

Preventing Data Loss

To prevent sensitive data from being lost or exfiltrated from our system, standard Data Loss Prevention (DLP) procedures are followed.

Preventing Fraud

Tax Form Hero takes several precautions to stop identity theft and stop fraudulent filings in compliance with IRS regulations. Preserving the integrity of our e-filing system and protecting our clients' sensitive data are our top priorities.

Verification of Identity

Tax Form Hero account is subject to the one-time identity verification process. Your information is secure for any subsequent dealings with Tax Form Hero once it has been validated. This simplified method offers ongoing protection in addition to time savings.

In particular, this aids in:

  1. Stop false claims for tax refunds.
  2. Get rid of unapproved form submissions
  3. Stop illegal credit card use
Patterns of Fraud

Our solution uses pre-established fraud patterns (unique for every form type) to automatically identify questionable tax filings. This assists us in avoiding false refund claims.

Wireless Protection

We prohibit illegal wireless networks from accessing our system in order to protect the privacy of all of our data.

Filtering Internet URLs

Access to websites with possibly damaging material (such as scam pages) is blocked across our network to stop any security threats from entering our system.

Preventive Actions

DevSecOps: Safe Software Creation

In order to guarantee secure software development with the application of common security measures throughout the development cycle, we test and deploy using the Dev Ops Methodology.

Modeling Threats

We create plans to eliminate and neutralize possible security risks and weaknesses as soon as our application is being developed.

Security of APIs

We have a specific security checklist for the APIs since there is a chance that they will reveal private information. This aids in locating and removing any possible security flaws in our API endpoints.

Management of Incidents

In the event of any unforeseen or unprecedented security incidents, we have simplified countermeasures in place.

Management of Change

To make sure that every modification is successful, we follow a consistent procedure that includes meticulous planning, investigation, and confirmation.

Security of APIs

We have a specific security checklist for the APIs since there is a chance that they will reveal private information. This aids in locating and removing any possible security flaws in our API services.

Management of Incidents

We have simplified safeguards in place in case of any unforeseen or extraordinary occurrences involving security.

Administration of Transformation

To make sure that every update is implemented without endangering the data, we use a consistent procedure that includes meticulous planning, testing, and validation.

Standards for Security

Policies for Security

To guarantee total data safety, we closely adhere to our security rules, which include a wide range of procedures and instructions, from periodic audits and assessments of vulnerability to access controls and encryption techniques.

Training on Security Awareness

The Tax Form Hero staff is well-versed in data security and consistently stays on top of emerging technologies and security measures that thwart security risks.

This awareness-raising culture reaffirms our dedication to data security and fortifies our collective defense.

Matrix of Escalation

The designated individuals and notification protocols for every escalation level are well-defined and being adhered to in the event of any security incidents.

Assessment of Security

Testing for Security

The OWASP guidelines, a thorough manual for locating and addressing security flaws in web applications, are in line with our penetration testing procedures. To find any weaknesses, we test our systems often.

Observation and Reaction

To find any possible security risks, we routinely scan and monitor our application and network. In order to take preventive steps to mitigate the threat, we analyze event logs whenever such a threat is detected.

Server/Windows Hardening

We put in place a series of server hardening procedures to get rid of the areas on our servers that could be attacked by hackers.