Security

What we actually do — and what we don't claim.

What we do

• TINs are encrypted at rest with AES-256-GCM (app-level encryption; the key lives only in the server environment, never in the database) and are only ever displayed masked to the last 2 digits. The vault database file is additionally created with 0600 permissions.
• Uploaded W-9 documents are stored encrypted on disk. API keys, collection tokens, and claim tokens are stored only as SHA-256 hashes.
• TIN format validated on entry (SSN XXX-XX-XXXX / EIN XX-XXXXXXX); no free-text surprises.
• All config via environment variables; structured JSON logging with no PII in log lines.
• We are not SOC 2 certified, and we make no "IRS approved" claim: live IRS transmission runs through IRIS under our own Transmitter Control Code.

What we don't claim

We are not SOC 2 certified, not ISO 27001 certified, and we don't use the phrase "military-grade encryption". If we name a cipher, we name the key management next to it. Security claims on this page describe the software as shipped — verified in the product repo, not in a badge.

Report an issue

Found a vulnerability? Email don+vault1099@lifeofmorr.com with details. We respond to good-faith reports promptly and don't pursue researchers who follow responsible disclosure.