Security
How we protect your clients’ returns
Business tax returns are some of the most sensitive documents a firm handles. Here is exactly how we look after them, in plain language, for you and for whoever reviews your vendors.
The binding promises are in our Terms, Privacy Policy and Data Processing Addendum. Send them, and this page, to whoever does your vendor review.
How we read returns
Google Cloud’s AI models read each return, following instructions and checks written for tax forms. Your data is never used to train any model, ours or our provider’s, and the provider keeps no copy of anything we send: zero data retention. The only copies of your files are in our own file storage, for 7 years from upload, unless you delete them sooner.
Where your data is
Only in the United States. Hosting, return reading, sign-in and file storage all run in US data centers.
Who can see your data
Only the people in your firm. The walls between firms are built into the system itself, not left to our code, and automated tests check them on every change. Our team doesn’t open your files except to fix a problem you report, keep the service running, or meet a legal duty. Every read of a stored file is logged.
Signing in
Email and password, or an existing work account. An authenticator app is required unless your firm makes it optional.
Keeping and deleting
Files are deleted 7 years after upload. Any member of your firm can remove a return at any time, which deletes its file and everything read from it. To delete all of your firm’s data, email privacy@sidesheet.co and we’ll do it within 30 days.
Client consent
Everyone in your firm confirms the client consent notice before they can upload. If your firm prepared a return, you need your client’s consent first.
Encryption
TLS 1.2 or higher in transit. AES-256 at rest for your files, account data and backups. Download links expire within minutes.
Reporting a problem
Email security@sidesheet.co. If a breach affects your data, we tell you within 48 hours.