Privacy Policy

Scope

This policy covers staff workspaces, the client portal, document processing, tax-year workflows, analytics, and administrative tooling shipped in TaxDesk PK.

Firm and client isolation

Access is designed around multi-tenant isolation:

• Application queries are scoped by firm identifier.
• PostgreSQL row-level security (RLS) isolates firm and client rows.
• Portal users are scoped to their client; unauthorized cross-firm access is denied without revealing other tenants.

Sensitive fields

The product treats national identifiers and financial credentials as sensitive:

• CNIC/NTN, full bank account numbers, IBAN, and stored IRIS credentials are designed for encryption at rest with per-firm envelope keys.
• CNIC values are masked in the UI by default; revealing a full value is an audited action.
• Account numbers default to last-four display; secrets are not shown again after entry.
• AI extraction schemas require storing only CNIC last-four from AI output — never a fabricated full CNIC.

AI processing and consent

Document assistance may use external AI only under product guardrails:

• Per-client AI consent is stored; per-client AI-off blocks external AI and falls back to manual or local flows.
• Before external AI calls, CNIC, full account numbers, and postal addresses are masked in outbound payloads and re-attached locally after extraction.
• AI call logs record metadata such as timestamp, firm, document, model, tokens, and cost — not raw document content.
• Spreadsheet mapping sends headers plus a small sample of rows, not the full file.
• Passwords for protected PDFs are used transiently in the browser and are not persisted.

Retention and deletion

Retention follows firm-configurable policy and owner-controlled deletion:

• Files are retained per configured retention; temporary processing files are deleted after use.
• Client archive retains data but removes the client from active lists.
• Permanent client deletion requires Owner permission, typed confirmation, and an audit log entry.
• Firm owners may request full export and deletion; deletion is logged and treated as irreversible in product requirements.

Security controls that protect privacy

Privacy depends on the security controls specified for TaxDesk PK:

• Staff authentication uses password plus mandatory TOTP; session tokens use HttpOnly Secure SameSite cookies, not browser localStorage.
• Uploads use magic-byte validation, malware scanning, size limits, encrypted object storage, and short-lived signed URLs.
• An append-only audit log records sensitive views, document access, AI calls, role changes, and related events.
• API surfaces require authentication on protected routes, input validation, rate limiting, and CSP headers.

Contact

For privacy requests about a specific firm’s data, contact that firm’s Owner or administrator. Platform operators should publish a support contact for their deployment. Counsel review is required before treating this page as a binding legal policy.