Security & Trust

1. Data isolation

Every firm's clients, engagements, documents, questionnaires, requested items and reminders are scoped to that firm in the database itself. Authorization is enforced by row-level security policies on each table, so a request that asks for another firm's records is rejected by the database rather than merely hidden by the interface.

Client accounts are restricted to the records they are authorized to see — their own engagement, their own documents and their own answers. Database triggers additionally prevent a client from changing firm-controlled fields such as readiness score, assigned staff member, engagement type, internal notes, CPA comments or document classification, even if the request is sent directly to the API rather than through the app.

2. Document protection

Uploaded documents and statements are stored in a private, access-controlled storage bucket. There are no public file links. Each view or download is authorized for the individual request and served through a short-lived link that expires within minutes.

Uploads are checked server-side before they are accepted: file type and size limits, verification that the file's actual structure matches its name, rejection of executables renamed as documents, rejection of PDFs carrying embedded programs or launch actions, rejection of macro-enabled spreadsheets, and rejection of the standard antivirus test file. Rejected files are deleted and the attempt is logged. This is a file-structure check, not a signature-based antivirus engine, and we describe it that way deliberately.

3. Encryption

All traffic between a browser and ReturnReady is served over HTTPS/TLS. Application hosting and TLS termination are provided by Cloudflare.

Database records and stored documents are encrypted at rest by our managed data platform (Lovable Cloud, built on Supabase infrastructure running on Amazon Web Services). Encryption at rest, key management and backup encryption are supplied by those providers rather than implemented by ReturnReady, and we describe them as provider-supplied rather than claiming our own cryptographic implementation.

4. Access controls

There are three roles today. Firm administrators manage the firm, its staff, reminder and security settings, and can delete client data. Firm staff work on clients inside their own firm. Clients reach only their own records. Role checks are evaluated in the database, not only in the interface.

Two-step sign-in using an authenticator app is available to every firm and is switched on by default for newly created firms. While a firm requires it, a staff member cannot open any client record until it is enrolled, and a valid six-digit code is required at each sign-in. The one exception is our shared public demo firm, which is deliberately exempt so that anyone can sign in with the published demo credentials. Signed-in sessions expire automatically after 30 minutes of inactivity, and each person can see the devices signed in to their account and revoke any of them, or sign out everywhere at once — in the public demo those device details are fictional and revoking is disabled.

Repeated failed sign-in attempts for the same email address are throttled: after five failures the form stops further attempts for roughly fifteen minutes.

5. Activity and audit logging

ReturnReady records invitations, document uploads and replacements, rejected uploads, document views and downloads, SmartSort classifications and firm confirmations, requirement and engagement status changes, follow-up requests and responses, reminders sent (including test sends and delivery outcome), readiness approvals, and client-data deletion requests.

Each entry records what happened, when, and which account acted. Log entries cannot be edited or deleted through the application by firm staff or clients.

6. Email privacy

Reminder and notification emails contain the client's first name, the firm and staff member's name, the tax year, the names of outstanding items, a due date where one is set, and a link back to the portal.

They do not contain tax figures, estimated liabilities, refund or balance amounts, profit-and-loss results, account or card numbers, Social Security numbers, or attached documents. Anything sensitive requires signing in to the portal.

7. AI and customer data

No customer document, answer or figure is sent to an AI service in this version of ReturnReady. Document identification (SmartSort) is rule-based and runs entirely inside our own servers: it reads the filename and any machine-readable text already present in the file, compares it against the firm's own clients and tax years, and reports a scanned or photographed page as "Unable to classify" rather than guessing.

AI does not calculate tax, prepare or review returns, or approve anything. Every SmartSort suggestion is labelled as a suggestion and requires a firm decision before it affects a client's readiness.

If we later introduce a feature that sends document content to a model provider, it will be off by default, disclosed on this page, and enabled only by a firm administrator — and we will not claim that content is never retained or never used for training until that is confirmed in the governing vendor terms.

8. Retention and deletion

Each firm sets its own retention target for client documents in Security settings; the default is seven years, reflecting common professional practice. ReturnReady does not automatically destroy documents when that period passes — deletion is carried out by the firm using the deletion workflow.

A firm administrator can permanently delete a client's data from Security settings. That removes the stored files and the related engagement, requirement and questionnaire records. The deletion request itself is retained as an audit record showing who requested it and when. These controls are disabled in our shared public demo firm.

Backups are managed by our data platform provider, which keeps automated daily backups with point-in-time recovery over a rolling window (currently seven days on our plan). Deleted records can therefore persist in provider backups until that window passes, after which they age out. Firms needing a contractual deletion timeline should raise it with us before signing.

9. Security reporting

If you believe you have found a vulnerability, email hello@getreturnready.com with "Security" in the subject line. That address is monitored. We will acknowledge legitimate reports and will not pursue action against good-faith research that avoids privacy violations, data destruction and service disruption.

A dedicated security@ address and a formal disclosure policy are not yet in place; we will publish them here when they are.

10. Compliance status

ReturnReady is developing its security program for handling sensitive financial and tax-related information. We do not currently claim SOC 2 or ISO 27001 certification.

We do not describe ReturnReady as "IRS compliant" or as satisfying any regulatory standard on your behalf. The platform is designed to help a firm protect client information and evidence how it was handled; each firm remains responsible for its own legal, regulatory and professional obligations, including its written information security plan, client consent, engagement terms and record-retention rules.

We have not yet completed an independent penetration test or external security assessment, and no part of this page should be read as a certification, warranty or guarantee.