Security at Taxpace and Pacekeeping

Version: 2026-10-12 · Status: draft for attorney review

Tax offices, accounting practices and people who keep their own books trust us with their most sensitive information and that of their clients. This page explains how we protect it. It describes what is in place today; items marked [planned] are on the way.

Encryption

• In transit: every connection uses HTTPS, including the links your clients use to upload documents.
• At rest:
  • the database and file storage are encrypted on disk by our hosting provider, DigitalOcean, in the United States;
  • Social Security and ITIN numbers are also encrypted field by field inside the database;
  • document files, including Pacekeeping statements, receipts and checks, are also encrypted with AES-256 before they are stored, with a key kept separately from the files.
• Downloads: files are never public. They open only through the application, after checking that the person asking can see that client.

Infrastructure: DigitalOcean

Taxpace and Pacekeeping run on the same platform, entirely on DigitalOcean, in data centers in the United States. We use its managed security services:

• App Platform: HTTPS certificates managed and renewed automatically, and protection against denial-of-service attacks.
• Managed PostgreSQL database:
  • encrypted at rest;
  • reachable only from our application, never from the open internet;
  • automatic daily backups with point-in-time recovery.
• Spaces (file storage): private storage, encrypted at rest. Our own AES-256 encryption is added on top of it.
• Our DigitalOcean account: protected with two-step verification, with access limited to the people who run the service.
• DigitalOcean's audits: DigitalOcean's data centers and services are independently audited. [Confirm DigitalOcean's current SOC 2 Type II and other reports before publishing.]

Access

• Sign-in: with Google, which protects the account with its own two-step verification, or with a password of at least 10 characters. With a password, a 6-digit code sent by email is also required (two-step verification); a device can be remembered for 30 days, and each user can sign out on all of their devices.
• Roles: each user sees only what their role allows. A user who cannot see a client sees nothing of that client.
• Client upload links:
  • each link is personal and expires;
  • the client confirms their date of birth before seeing anything;
  • after 5 failed attempts the link locks, and the firm is notified.
• Taxpayer numbers: full Social Security numbers never appear in lists, web addresses or logs. Spouses' and dependents' numbers keep only the last 4 digits.

History and monitoring

• Activity history: every client keeps a history of who created, changed or deleted their records and documents, and when.
• Error monitoring: errors are monitored without sending client data to the monitoring service.

Data separation

Each account's data is kept apart from every other account's data. [One database per firm — [planned], see #187.]

Backups

DigitalOcean backs up the database automatically every day and keeps point-in-time recovery for the last [7] days. [Restores are tested every quarter — [planned].]

Our team

• Access to production: only the people who need it, with two-step verification.
• No routine access: nobody at Twenty Techworks looks at client data in day-to-day work. When a subscriber asks for support that requires it, the access is recorded.
• Changes: every change to the software is reviewed and tested automatically before it is released.

Compliance

• FTC Safeguards Rule: our Data Processing Agreement gives firms the written commitments the Rule requires from service providers.
• IRC §7216: we use taxpayer information only to provide the service. We never sell it and never use it to train AI.
• Artificial intelligence: documents read with artificial intelligence (for example, statements in Pacekeeping) are sent to Google Gemini, on its paid tier, only to read them. They are not used to train models. See the subprocessor list.
• Data location: data stays in the United States.

Report a vulnerability

If you find a security problem, write to [email protected]. Please do not test against other accounts' data. We will acknowledge your report within 3 business days.