Security

Last updated: 18 October 2026.

Security

This page says what we do to protect your data, in plain words. It also says what we do not claim. Pingtail handles tax and financial documents, so we encrypt files before they reach storage and keep them private to the firm that asked for them.

We do not currently hold SOC 2 or ISO 27001 certification. We would rather describe our real measures than suggest a badge we do not have.

Need one document for your own written security plan or vendor file? Use the Security overview for your records. It prints on a few pages.

Encryption

• The application encrypts every file before it reaches storage. We use AES-256-GCM.
• Each file has its own key. A master key wraps the file keys. The master key is kept apart from the stored files.
• Our file storage provider holds only ciphertext. It cannot read your files.
• All traffic between browsers and the service uses TLS.

Access

• The storage bucket is private. There is no public access and there are no public file links.
• Downloads go only through the application, and only for a signed-in member of the firm that owns the file.
• Passwords are hashed with argon2id. We never store them in readable form.
• Firm users can add two-step login: a code from an authenticator app after the password or the emailed sign-in link. The firm owner can require it for everyone in the firm.
• Each person can see their signed-in sessions and sign out everywhere. Sensitive actions ask for a fresh code.
• We use CSRF protection, rate limits and a strict content security policy.

The client link

• Clients open a private link from an email. They do not need an account or a password.
• Each link is a long random token. We store only a hash of it, so a copy of our database does not reveal working links.
• Each link is bound to one request. It does not open anything else.
• If the link is opened on a second device, that device must enter a code that we send to the client's email.

Uploads and malware

• We accept only PDF, JPG, PNG, HEIC, CSV, XLSX and DOCX files, up to 25 MB each.
• We check the type against the real file bytes, not just the file name.
• PDFs with scripts or embedded files are refused.
• Files are never executed on our servers.

AI checks

• An AI model reads each upload to see if it matches what the firm asked for. The document is sent to the AI model provider only to perform this check.
• Under the provider's API terms, documents sent to it are not used to train its models.
• The AI result is a suggestion. It never rejects a file. People decide.
• A firm can switch AI checks off in its settings. The file type, safety and rule-based checks still run.

People

• We are a small company. Only the few people who run the service can reach the servers.
• Customer files are ciphertext at rest. We open a customer's documents only when the customer asks us to, for support.

Logging and audit

The service keeps an audit log of views, downloads, accepts, send-backs and deletions. We also keep security logs, such as sign-ins and blocked requests, and review them when something looks wrong.

Backups and recovery

We take encrypted backups of the database every night, and keep the newest 14. Uploaded files stay encrypted in object storage at all times. We do not publish a formal recovery time target today.

Deletion

• A firm can delete any file, request or client, or its whole account, at any time.
• Deletion removes the stored object and its encryption key. The file cannot be recovered, by us or by anyone else.
• A client can delete or replace their own upload until the firm accepts it.
• The firm sets how long files are kept. The default is 7 years on paid plans. On a read-only account (no active plan), files are deleted 90 days after a request is completed.

Hosting and sub-processors

Our application server and database are hosted in the EU (Finland). These companies handle data for us. We give notice before we add or replace one, as the Data Processing Agreement says.

Name	What for	Where
Hetzner	Servers: run the application and the database	Helsinki, Finland
Cloudflare (R2 storage)	Stores uploaded files and database backups. Ciphertext only.	Set in our Cloudflare account; not stated on this page
Resend	Sends our emails to your clients and to you, and receives files that clients email back	Not stated on this page
Anthropic	Reads an upload to suggest whether it matches the request. A firm can switch this off.	Not stated on this page
Meta (WhatsApp Business Platform)	Delivers WhatsApp messages, only for firms that use WhatsApp	Not stated on this page
PayPal, Razorpay	Take payment for subscriptions. They never receive client documents.	Not stated on this page

Services you connect yourself (Google Drive, Dropbox, QuickBooks, Xero and others) are not our sub-processors. They get only what you tell Pingtail to send.

What we do to your clients' books

• For QuickBooks and Xero, Pingtail reads, creates and adds. It never deletes, trashes, moves or renames anything in them.
• Nothing is written to the books until your firm approves it.
• When a feature changes a line that already exists, we keep the value before and the value after, and the firm can undo it. This has been tested on our own QuickBooks test company, not on customers' books.

Your rights

• Download everything: Settings, then Your data. The owner or an admin can ask for a file of your clients, requests and documents at any time.
• Delete: the owner can delete the firm in the same place, and can undo it for 30 days. After that the files and your clients' details are erased.
• If one of your clients asks to have their documents deleted, the request arrives in Settings, Your data, for the owner to approve.
• Other requests about your data: dipa@pingtail.com.

Planned

We plan to get a SOC 2 report and an independent penetration test. We have no date for either, and we will not call ourselves certified or tested before they are done.

Abuse protection

Emails to clients show the firm's name, and replies go to the firm. Every client email and page has a "report this request" link. One report pauses that firm's sending until we have reviewed it.

Incident response and breach notice

If we find a security incident, we contain it, find the cause, and fix it. If a breach affects a firm's client data, we notify the firm without undue delay, and in any case within 72 hours of becoming aware. This is a promise in our contract, not a certified process. We say what happened, what data is affected, and what we are doing. Our Data Processing Agreement sets this out.

Responsible disclosure

If you find a security problem, email dipa@pingtail.com. We will reply. Please do not access other customers' data, do not disrupt the service, and give us reasonable time to fix the problem before you publish it.

For US tax preparers: FTC Safeguards Rule and IRS Publication 4557

US tax preparers are asked to have a written security plan and to check their vendors. This table shows how our measures line up with the usual questions. It is not a certification and it is not legal advice. Your firm remains responsible for its own security plan.

Topic	What we do today	Gaps to know about
Encryption	AES-256-GCM per file before storage. TLS in transit. Encrypted nightly database backups.	We hold the keys. A firm cannot hold its own.
Access control	Private storage. Downloads only through the application for the signed-in firm. Hashed, single-request client links.	Two-step login is optional unless the firm owner requires it. See the next row.
Multi-factor sign-in	Two-step login for firm users with an authenticator app (TOTP) and one-time recovery codes. It applies to password and email-link sign-in. The firm owner can require it for the whole firm. Client links need an email code on a second device.	Authenticator app only. No security keys, no SMS codes and no single sign-on. Clients have no login, so it does not apply to them.
Monitoring	Audit log of views, downloads, accepts, send-backs and deletions, and of two-step login changes. Security logs and rate limits.	We do not run a staffed, round-the-clock monitoring team.
Disposal	Deletion removes the file and its encryption key. The firm sets retention. Automatic deletion applies to read-only accounts.	Encrypted database backups expire on their own schedule, not at the moment of deletion.
Incident response	Contain, investigate, fix. Notice to the firm within 72 hours of becoming aware.	The process has not been audited by a third party.
Vendor oversight	A small set of named providers (table above). Storage holds ciphertext only. Notice of changes.	We rely on our providers' own security reports. We do not audit them ourselves.
Certification	None.	We do not currently hold SOC 2 or ISO 27001 certification. A SOC 2 report is planned (see above).

Questions

Security questions and reports: dipa@pingtail.com. General support: dipa@pingtail.com. We answer reasonable security questionnaires from customers.

Pingtail Partners, NH231, Above Axis Bank, Gulabbagh, Purnia, Bihar 854326, India · +91 91801 85753 · dipa@pingtail.com