Encryption
Connections use TLS in transit. Social Security numbers, EINs, and dates of birth are encrypted at rest with AES-256-GCM. Only the last four digits of a tax ID are stored in plaintext so staff can search and display a masked value.
Trust Center
Security practices for tax documents and payments
Prospects should know how W-2s, identification documents, and bank statements are handled before they upload a file. This page describes what HeyRoca actually runs today — not a future certification.
Built for independent tax and accounting firms. Keep your existing tax-preparation software.
Private document vault
Client files live in a private object store. Browsers never receive a public bucket URL. Downloads go through authenticated app routes after HeyRoca checks the signed-in firm, portal client, or e-sign token.
Multifactor authentication
Staff must complete MFA before entering the firm app. Client portal users can enroll MFA, and firms can require it. Authenticator apps (TOTP) and emailed one-time codes are supported. SMS MFA is not offered. Enrollment, verification, failures, and staff-assisted resets are written to the audit log.
Sessions and passwords
Staff and portal web sessions use an approximately 8-hour JWT lifetime configured in operations. Passwords must be at least 10 characters with a letter and a number, and known breached passwords are rejected. Password reset does not skip MFA on the next sign-in if MFA is enrolled or the firm requires it.
Access control and e-sign
Staff roles (owner, admin, member) gate sensitive actions. E-sign links use unguessable tokens. Firms can require a short-lived email code before a signer sees the document.
Payments
Firm subscriptions and client invoices are processed by Stripe. Client billing uses Stripe Connect so payments go to the firm’s Stripe account.
Backups
PostgreSQL runs on our application servers. Operators keep off-box database backups against an internal restore objective. We do not publish an RPO or RTO. Operators should enable object versioning on the private document bucket (Cloudflare R2 or S3). Cross-region replication is optional and is not a current product guarantee.
Subprocessors and contact
Infrastructure used to run the service: Stripe, Resend, Cloudflare R2, and PostgreSQL on our application servers. If we confirm a security incident that affects a firm’s customer data, we notify that firm within 72 hours of confirmation. Security contact: [email protected]. Firms can request deletion of customer data at that address.
SOC 2
HeyRoca is not SOC 2 certified. A formal audit is on our roadmap. We will not describe the product as SOC 2 compliant until an independent report is complete. We do not claim penetration-test reports, personnel background checks, or a published RPO/RTO.
Data Processing Addendum
A public draft DPA is available at /dpa. Counsel should review it before you rely on it in a customer contract. You can also reach us at [email protected].
Related: Privacy Policy · Terms of Service · DPA · Integrations