Data processing

For information a firm collects from its clients through ReturnReady, the firm is the controller and ReturnReady is the processor. We process that information only to provide the service and only on the firm's instructions.

For a firm's own account information (staff names, emails, billing contacts), ReturnReady is the controller.

Identity and contact details of firm staff and clients.

Tax-intake answers, requested-item status and firm notes.

Uploaded documents, which commonly contain financial and government-identifier information.

Activity and audit records, and technical server logs.

Application hosting and content delivery: Cloudflare (edge hosting of the web application).

Database, authentication and private file storage: Supabase, running on Amazon Web Services.

Transactional email delivery for invitations and reminders: Resend.

We will notify firm administrators by email before adding a subprocessor that processes client documents.

Database records and documents are stored in the United States. The web application is served from a global edge network, which processes requests in transit only and does not retain client documents.

TLS for all traffic; encryption at rest for the database and document storage.

Row-level security policies enforcing firm-level separation on every query.

Private storage with no public file URLs; authorized, time-limited download links only.

Role-based access for firm administrators, firm staff and clients.

Audit logging of invitations, uploads, status changes, requests, reminders, approvals and downloads.

Managed automated backups with point-in-time recovery provided by the database platform.

ReturnReady has not completed a SOC 2 or ISO 27001 audit and makes no certification claim.

Data is retained while the firm's account is active. On written request we delete or return a firm's data within 30 days, except where retention is legally required.

A firm administrator can record the firm's retention target and permanently delete an individual client's data from Security settings. Automatic enforcement of a retention schedule is not available; deletion is carried out deliberately by the firm.

No customer document, answer or figure is sent to an AI service, so there is no AI subprocessor for client content.

If we become aware of a breach affecting a firm's data, we notify the firm's administrators without undue delay with the facts known at the time and the steps taken.

Firms that need a signed data processing agreement can request one at hello@getreturnready.com.