ISO 27001:2022 certified. Penetration tested every year. Hosted on AWS in Australia, with client data that never leaves the country. This page answers what a security review asks, and the Enterprise Security Overview carries the evidence.
Certified by Equal Assurance, a JAS-ANZ accredited body. The certificate is current to April 2028 and is included in the Enterprise Security Overview.
The latest test returned a Low Risk result. No critical, high or medium findings remain open.
SOC 1 Type II and SOC 2 audits are under way. Until the reports are issued, the Security Overview sets out our controls against the SOC 1 control objectives so your SOX team can review them now.
TaxTime lodges through the ATO’s Standard Business Reporting channel as a registered Digital Service Provider, which carries its own security requirements.
Professional indemnity, technology liability, cyber and public liability insurance are all in place, placed through Lloyd’s and Allianz. Certificates of currency are in the Security Overview.
Client data is stored, processed and backed up on AWS in Australia and is not transferred outside the country.
Every client has its own workspace. On Enterprise, that workspace runs in a dedicated AWS account with its own network and identity boundaries, and database traffic travels over private peering rather than the public internet.
The application and data tiers run across multiple data centres in Australia, behind a web application firewall with managed rule sets, and the whole environment is defined as code so it can be rebuilt from scratch.
Databases, documents, secrets and backups are encrypted at rest. Every connection, including internal service traffic, is encrypted in transit.
Multi-factor authentication is mandatory for every user. Accounts lock automatically after failed attempts. Enterprise single sign-on through SAML 2.0 and OIDC federates with your own identity provider.
Admin, member and reviewer roles, with separate permissions for importing, editing, reviewing, approving, lodging and administration. Nobody is an admin by default. Access rights are reviewed monthly and whenever someone changes role or leaves.
Distinct roles and workflow assignments keep preparation, review and sign-off apart, and reviewed work is locked. Unlocking is governed and recorded.
The only personal information routinely processed is the name, work email and role of authorised users. The platform is not designed to hold individual taxpayer data.
Nothing in the application acts on client data by itself. Where AI is used, it is your own AI agent, connected through an authenticated gateway as a named user with the same roles and the same audit trail.
How the AI agent boundary worksUser actions, data changes and configuration changes are logged and kept indefinitely. The business record carries the rest.
GL load versions with the source file, who loaded it, when, record counts and status. A preview of inserted, updated, deleted and unchanged records before anything is applied, and the ability to revert to an earlier load.
Field-level previous and revised values on workpapers, tax-return field history, adjustment history, and the source and context of each change.
Workflow transitions, review actions, comments and sign-offs under the name that made them, whether a person or an AI agent. Signed-off work is locked, and unlocking is recorded.
Continuous point-in-time recovery, with hourly snapshots kept for 2 days, daily for 7 days, weekly for 4 weeks, monthly for 12 months and a yearly snapshot. All encrypted.
Multi-AZ deployment with continuous monitoring. An operational target that applies to every subscriber, as set out in the Subscription Agreement.
Automated failover and a full environment restore from code (Terraform). Recovery exercises are run and reported; the latest exercise report is available on request.
A Business Continuity Policy under the ISMS sets recovery priorities, covers key-person risk through documentation and cross-training, and requires annual testing.
Incidents are classified within an hour of being reported and contained immediately. Major incidents get a response within an hour, minor ones within a business day.
For a major incident touching client data or availability you are told as soon as it is confirmed, targeting 24 hours from classification. If you need to meet your own obligations under the Notifiable Data Breaches scheme, you are told of a suspected incident before it is confirmed.
Ongoing updates until resolution, a post-incident review within five business days, and a post-incident report on request.
Full export of your data through the application at any time, in formats your next system or your auditor can read.
You are told the termination date and the export window. After 30 days your data is deleted from production and backups expire on their schedule. Deletion confirmation is provided on request.
Your Tax Ledger, your rules, your evidence. Advisers and auditors work in your workspace on your terms, and nothing is locked in another vendor’s or a firm’s tool.
Infrastructure, database, identity and transactional email, each ISO 27001 or SOC 2 certified. Suppliers are assessed for certification, Australian data storage, recovery plans and 24-hour incident notification before approval. Postmark carries notifications, never client data.
Branch protection, mandatory peer review, static and dependency scanning, container scanning on every build, and the full regression suite on every deployment. Changes go through lab and staging before production, with rollback by version.
AWS Inspector scans hosts and container images continuously. Findings run through a vulnerability management procedure, and critical patches are expedited under an emergency patching procedure.
Every client runs the same release, built and supported for everyone. You control when each release lands in your workspace, so nothing changes during a close.
The Enterprise Security Overview covers architecture, hosting, access, data handling, operations, incident response and the AI boundary model, with the ISO 27001 certificate, the penetration test attestation and insurance certificates as appendices. The disaster recovery exercise report and the Subscription Agreement are available with it, and we answer security questionnaires from the same source.
How personal information is collected, used and kept is set out in the privacy policy. Privacy enquiries go to privacy@taxtime.app.
Privacy policy
Start with a 30-minute call with Andrew or Jim about how your close runs today.
