Data Security

Our team understands the importance of safeguarding our client’s data. To ensure that all of our client's data is safe, we have implemented various methodologies and maintained multiple layers of security measures.

Here is an overview of the security standards and protocols set in place by TaxBandits to ensure our client’s
data is protected.

Compliance

  • SOC 2 Compliance

  • SOC 2 certification is a security standard for service organizations developed by the American Institute of CPAs (AICPA). It requires companies to establish and maintain a set of controls and procedures to ensure the confidentiality, integrity, and availability of client data.
  • These controls include policies and procedures related to security, availability, processing integrity, confidentiality, and privacy. SOC 2 audits evaluate whether a company's systems and processes meet these standards.
  • As a SOC 2 certified e-file provider, TaxBandits undergoes regular audits to ensure that its system and processes meet the SOC 2 standards. This means that TaxBandits has established and maintains a set of controls and procedures to protect client data and privacy throughout every aspect of operations.

  • HIPAA Compliance

  • The Health Insurance Portability and Accountability Act (HIPAA) is a US federal law that sets standards for the protection of Protected Health Information (PHI).
  • PHI includes any information that can be used to identify a patient or their health condition, and as such, it is highly sensitive information that requires strong security measures to protect it.
  • As a provider of services that handle PHI, TaxBandits has implemented all the required security measures to comply with HIPAA regulations. These measures include technical, physical, and administrative safeguards to ensure the confidentiality, integrity, and availability of PHI.

  • CCPA Compliance

  • The California Consumer Privacy Act (CCPA) is a privacy law that gives California residents certain rights over their personal information (PI).
  • PI includes any information that identifies, relates to, describes, or can be associated with a particular person or household.
  • As a provider of services that handles PI of California residents, TaxBandits adheres to all the regulations of the CCPA. This means that TaxBandits provides California residents with the right to know what PI is being collected, the right to access their PI, the right to have their PI deleted, and the right to opt out of the
    sale of their PI.

  • PCI DSS Compliance

  • The Payment Card Industry Data Security Standard (PCI DSS) is a set of policies and procedures established to ensure safe credit, debit and cash card transactions and prevent the misuse of personal information of the cardholders.
  • All the payment processing tools used by TaxBandits adhere to PCI-compliance requirements for encrypting and securely transmitting credit card data.

Data Protection

  • 2FA- Authentication

    TaxBandits clients can enable 2-FA Authentication and add an additional layer of security to their account. We provide our clients with an option to choose from Google Authenticator, Authy by Twilio, Microsoft Authenticator, Last Pass, and the 2FA Authenticator applications.

  • Firewall

    We implemented a Web Application Firewall that filters incoming traffic, scrutinizing requests for malicious patterns, ensuring only authorized and authentic access.

  • Antivirus

    Our system is protected by antivirus software that continuously monitors device behavior, files, and applications, identifying anomalies and thwarting potential threats.

  • PII Data Security

    We follow all the standard regulations of PII data security to ensure that our clients’ personal information (Social Security numbers, email addresses, phone numbers, etc) are secure.

  • Encryption - Data-in-Rest, Data-in-Motion & Data-in-Use

    We encrypt all client data that is stored in our database (Data-in-rest) and data that is transmitted between networks or devices (data-in-motion).

    We also follow SSL (Secure Sockets Layer) and TLS (Transport Layer Security) cryptography protocols to encrypt the data that is being accessed or read (Data-in-use) at any given time.

  • Database Management

    Access to production databases is restricted to only those who have a specific need to access the production data. We also perform data fragmentation and frequently carry out data backups as a preventive measure against unprecedented security incidents.

  • Defense In-Depth Security

    We follow Defense-in-depth security architecture, i.e., layered security that incorporates different levels of security mechanisms and controls.

  • Oracle Cloud Infrastructure Security

    Our database is maintained through Oracle Cloud Infrastructure Security, and our servers are under Compute Security protection.

    A dedicated whitelist is associated with an individual instance in the cloud, allowing only specific sources to communicate to the instance.

  • Data Loss Prevention

    Standard Data Loss Prevention (DLP) practices are carried out to avoid loss of sensitive data and data exfiltration from our system.

Network Security

  • Secure Remote Access - VPN

    Access to all our servers, data, and tools has been restricted to allow only authorized TaxBandits corporate personnel who are connected through our secure VPN network. Only the IP addresses from selected geographical locations that we have authorized can access our network.

  • Wireless Security

    Accessing our system through any unauthorized wireless networks is restricted to prevent the confidentiality of all our data.

  • Internet URL Filtering

    To prevent the entry of any security threats into our system, access to websites that contain potentially malicious content (Eg: Phishing Pages) is restricted throughout our network.

Preventive Measures

  • Secure Software Development -DevSecOps

    We follow the Dev Ops Methodology for Testing and deploying to ensure secure software development with the implementation of standard security measures throughout the development cycle.

  • Threat Modeling

    We formulate strategies to negate and nullify potential security threats and vulnerabilities right at the development of our application.

  • API Security

    As there is a possibility of APIs exposing sensitive data, we have a designated security checklist for the APIs. This helps us identify and eliminate any potential security vulnerabilities in our API endpoints.

  • Incident Management

    We have streamlined countermeasures in place in case of any unprecedented and unexpected
    security incidents.

  • Change Management

    We adhere to a standard process that involves careful planning, testing, and validation to ensure that every change is introduced without posing any risks to the data.

Security Standards

  • Security Policies

    Our security policies comprise numerous measures and guidelines starting from access controls and encryption protocols to regular audits and vulnerability assessments, to which we strictly adhere to ensure complete
    data protection.

  • Security Awareness Training

    The team at TaxBandits has a clear-cut understanding of data security and constantly stays ahead of new technologies and security mechanisms that counter security threats.

    This culture of awareness strengthens our collective defense and reinforces our commitment to data security.

  • Escalation Matrix

    In the event of any security incidents, the responsible personnel and notification procedures for each escalation level are clearly designed and are being followed.

Security Evaluation

  • Penetration Testing

    Our penetration testing practices are aligned with OWASP standards, a comprehensive guide to identifying and mitigating security vulnerabilities in web applications. We frequently test our systems to uncover potential vulnerabilities.

  • Monitoring and Response

    We regularly monitor and scan our network and application to identify any potential security threats. When there is such a threat identified, we perform event log analysis to respond with proactive measures for
    negating the threat.

  • Windows/Server Hardening

    We implement a sequence of server hardening processes to eliminate the potentially vulnerable points for security attacks in our servers.