Privacy
Last updated November 11, 2026.
Firm workspace
Client records, returns, and documents are encrypted in your browser with your firm’s key before they are stored. We hold only the encrypted data and cannot read it. We do see firm names, staff email addresses and roles, and when records change.
Signing in
We use your email address to send sign-in links and codes. Your two-step sign-in key is stored encrypted, and recovery codes are stored only as one-way hashes.
Signing links
When you sign a document from your preparer, the document is decrypted only on your device. We record the name you type, the time, your IP address, your browser, and a fingerprint of the document, so the signature can be checked later. Your preparer keeps this record with the signed copy.
Client upload links
If your preparer sends you an upload link, your files, their names, and any questionnaire answers are encrypted on your device before they are sent. Files your preparer does not import within 30 days are deleted. We cannot read them. We process your IP address briefly to limit abuse.
Your responsibilities as a firm
You are responsible for your clients’ information, including Section 7216 consents, your written information security plan, and who you give access to.
Without a firm account
The standalone preparer stores answers in your browser only. Social Security and bank numbers are typed at the last step and are not saved.
Documents you read
Reading a document happens in your browser. Files are stored only if you add them to a client file, and then only encrypted.
Payments
If your firm subscribes, payment is handled by Stripe. We never see card numbers; we keep your Stripe customer ID and plan status.
What our servers log
Standard request logs such as IP address and pages requested, kept by our host, Cloudflare. We use no advertising or tracking scripts.
Shared computers
Anyone using your browser can open a saved return. Use the erase button when you finish on a shared computer.
Contact
support@willittax.com