Security & data handling
1040 Parser is built for teams that handle sensitive documents. Here is exactly how we protect your data — in plain language, so you can evaluate it before you build on the API.
Encryption everywhere
All traffic to and from the service is encrypted in transit with TLS (HTTPS). Documents and extracted data are stored in an encrypted-at-rest PostgreSQL database. Your files move over encrypted channels from upload through processing to storage.
Your data is yours
We process your 1040 returns to return structured data. We do not use them to train our own models. Plan-based retention and user-initiated deletion controls limit how long extraction records remain available.
Scoped, hashed API access
Every account authenticates with API keys that are scoped to that account and stored hashed at rest (never plaintext). Keys can be rotated or revoked instantly. Requests are rate-limited to protect your account and ours.
Secure payments
Billing runs entirely through Stripe. Card details go directly to Stripe over its PCI-compliant infrastructure — they never touch our servers, and we never store card numbers.
Tenant isolation
Extraction records are segregated per account using database row-level security plus ownership checks in authenticated routes. These controls are designed to prevent one customer from reading another customer’s records.
Subprocessors
We use a small set of trusted infrastructure providers to run the service:
Compliance posture
The controls above describe the current standard service; they are not a certification or a promise that every regulatory framework applies to your use case. If your organization requires a formal review, data-residency terms, or a Business Associate Agreement, contact us before uploading regulated data.
FAQ
Do you use my documents to train AI models?
We do not use your 1040 returns to train our own models. Documents are sent to the listed processing providers to return extraction results; review the Privacy page and current provider terms before uploading sensitive data.
How long do you keep my documents and data?
Extraction records receive a plan-based expiration date and are removed by scheduled cleanup. You can also delete an extraction from your dashboard or with a full-access API key.
Are my API keys stored securely?
Yes. API keys are stored hashed at rest, never in plaintext. Treat your key like a password; you can rotate or revoke it in the dashboard.
Can I upload protected health information (PHI)?
Do not upload PHI unless you have first confirmed the required controls and a signed Business Associate Agreement with 1040 Parser. The standard service is not represented as HIPAA-compliant by default.
How do I report a security issue?
Email john@soxoa.com with details. We take responsible disclosure seriously and will respond promptly.