Your clients' credentials, and who can reach them
A tax practice hands its software NTNs, STRNs and portal logins for other people's businesses. This page describes how those are separated and stored — and, at the end, what has not been proven yet.
14 days of full access. No card required, and nothing is charged when it ends.
One firm cannot see another firm
Separation is enforced by the database, not by the application remembering to filter. A query that forgets its firm returns nothing rather than everything.
- Row-level security, forced
- Every table carrying firm data has row-level security enabled and FORCEd. Enabling alone leaves the table's owner exempt from its own policies; FORCE removes that exemption. Both states are read back from the live database, not assumed from the migration that set them.
- Every statement runs inside a tenant
- Reads and writes are wrapped in a transaction that sets the firm for its duration and clears it afterwards, so the firm a statement runs under is never inherited from a previous one.
- Proven by breaking it
- The isolation controls are checked by removing them and requiring the suite to fail. A test that passes with the protection deleted has proven nothing, so those are treated as defects in their own right.
- Separate origins for site and workspace
- The public site and the signed-in application are separate origins, and session cookies are host-only — issued for the workspace and never sent to the marketing site.
Portal credentials
FBR, SECP, SRB and PRA logins are the most sensitive thing in the product, and they are treated differently from everything else.
- Encrypted at rest
- Secrets are encrypted with AES-256-GCM before they reach the database and decrypted after they leave it, so a database dump or a storage snapshot does not contain readable passwords.
- Reading one requires a reason
- Revealing a secret is an explicit action that asks why, records who asked, and does not keep the answer on screen. Closing without revealing leaves no trace of a secret, and a second reveal asks again.
- The application has no direct grant
- The role the application connects as cannot read the secrets table at all. Access is through a single reviewed function, so there is one path to audit rather than every query in the codebase.
- Passwords are never stored
- User passwords are hashed with scrypt, a memory-hard function from the Node standard library, and compared without revealing timing. The plain password is not stored and cannot be recovered — only reset.
Who can see what, inside a firm
Separation between firms is not enough on its own. A consultant should not see the firm's whole book merely because they work there.
- Roles carry operations, not screens
- Permission is checked against the operation being performed rather than the page being viewed, so a hidden button is never the only thing standing between somebody and an action.
- Assignment scopes the view
- A consultant assigned to particular clients sees those clients. The scope is applied where the data is read, so it holds for the API as well as the interface.
- Refusal is explicit
- A role without a grant meets a closed door that says so, rather than an empty table that looks like the firm has no records.
- The trail is the record
- A client's history is derived from the firm's audit trail rather than kept as a second log that can drift from it, so what you read is what was recorded.
What this page does not claim
Taxira's production infrastructure is being provisioned. The controls above are in the software and verified; the items below depend on hardware and are not yet proven, so they are listed rather than implied.
- Backup and restore
- A backup that has never been restored is a file, not a backup. Restore — including recovery of the key that decrypts credential secrets — is rehearsed before any firm is asked to rely on it, and this page will say so when it has been.
- Recovery times
- Recovery point and recovery time targets exist as vendor figures. Until they are observed against the real deployment they are targets, and stating them as guarantees would be stating somebody else's estimate as our promise.
- Independent assessment
- Taxira has not been penetration-tested by an outside firm and holds no security certification. The verification described above is our own, and is automated rather than a one-off review.
- Reaching a person
- A dedicated channel for reporting a vulnerability opens with the production deployment. Until it does, this page will not print an address that cannot receive mail.
Start with your own data
The trial is a real workspace on real infrastructure, not a sandbox with sample records. Create an account and see how your firm's work sits in it.