Data security

Secrets are write-only, in the software

Three fields can be written and never read back:

• your IRS self-select PIN,
• the signing officer’s Social Security number,
• your bank account number for Electronic Funds Withdrawal.

There is no page, no export and no support tool that can display them. The system returns only a presence flag or a masked form: ***-**-1234, ****5678. This is enforced at the point the data leaves the database, so it holds for every route, not just the screens we remembered to mask.

Encryption

All traffic is served over TLS; the site is not reachable unencrypted. Sensitive fields are encrypted at rest, separately from transport encryption.

Documents are not on a public URL

Your stamped Schedule 1 and your filed return are taxpayer documents, so they are not served from a public file path where a guessed or leaked URL would expose them. They are streamed through an authenticated endpoint that checks the document belongs to the account asking for it. A link copied out of your browser will not work for anyone else.

Sessions

Your session refresh token is held in a cookie that JavaScript cannot read, so a scripting flaw on a page cannot carry your session away. Signing out clears it on our server, not just in your browser. The alternative leaves a session that quietly signs you back in.

Card details never reach us

Payment card information goes directly from your browser to our payment processor. Our servers never see a card number and there is no endpoint that accepts one.

What we do not claim

We do not claim a security certification we have not been audited for. If you need documentation for a vendor review, write to support@2290.agency and we will tell you what we can evidence.

Reporting a problem

If you believe you have found a vulnerability, email support@2290.agency with enough detail to reproduce it. Please do not test against other customers’ accounts or data.

See also our privacy policy.