Role
Hosting + CDN for the Taxottic web app.
Data processed
HTTP request metadata, IP at request time (not stored long-term).
Region
United States (global edge for static assets).
Certifications
SOC 2 Type II, ISO 27001, GDPR-aligned DPA.
Subprocessors
Who else processes your data.
Last updated: 2026-10-17
To run Taxottic we rely on a short, vetted list of vendors. We do not engage a new subprocessor without first reviewing their security practices and data-protection commitments. We update this page when we add or change a vendor and announce material changes in-app at least 30 days before they take effect.
The certifications listed below are the vendors' own, not Taxottic's. Taxottic has not been through a third-party security audit, and we do not claim one.
Role
Postgres database, authentication, storage of user files.
Data processed
All application data (tax profiles, expenses, conversations, bank metadata).
Region
United States (AWS us-east-1).
Certifications
SOC 2 Type II, HIPAA-eligible, GDPR-aligned DPA.
Role
Bank connectivity, transaction sync.
Data processed
Bank account ID, transaction merchant + date + amount, institution name. Bank credentials are entered into Plaid's UI and never reach Taxottic.
Region
United States.
Certifications
SOC 2 Type II, ISO 27001:2013, AICPA SOC for Service Organisations.
Role
Powers Bella (our in-app AI guide), reads the receipts, pay stubs, W-2s and prior-year tax documents you scan, and suggests categories for imported bank transactions.
Data processed
Your questions to Bella and recent conversation turns, a summary of your tax and company situation including year-to-date income and expense totals, the complete file you scan (the whole image or PDF is sent, not only the fields we ask for), and bank transaction descriptions, amounts and dates.
Region
United States.
Certifications
SOC 2 Type II. Under our commercial terms, customer content is not used to train general models.
Role
Subscription and credit-pack billing, and, if you connect one, Stripe as an income source.
Data processed
Email, billing address and payment details you enter in Stripe-hosted checkout. Card numbers never reach Taxottic and we store none. For a connected Stripe account, the payout and charge records we sync back.
Region
United States.
Certifications
PCI DSS Level 1, SOC 1 / SOC 2 Type II, ISO 27001.
Google Maps Platform
Their privacy notice (opens in a new tab)Role
Draws the maps and route thumbnails on the mileage screens, turns coordinates into place names, and suggests and geocodes addresses you type.
Data processed
Precise trip coordinates. Route points are included in the map-image request, and the first and last point of a drive are sent to be resolved to a street address and a nearby business name. What you type into an address field (saved places, Home and Work, a business or firm address, the stops of a rebuilt drive) is also sent, as you type, to suggest matching addresses.
Region
United States and Google's global infrastructure.
Certifications
ISO 27001, SOC 2/3.
Google (sign-in and push)
Their privacy notice (opens in a new tab)Role
Optional sign-in via Google OAuth, optional Google Calendar connection, and delivery of Android push notifications via Firebase Cloud Messaging.
Data processed
Name, email, profile photo from the openid email profile scopes. Calendar data only if you connect a calendar. For push: your device token and the short notification text.
Region
United States.
Certifications
ISO 27001, SOC 2/3, FedRAMP.
Role
Delivery of push notifications to iPhones and iPads.
Data processed
Your device token and the short notification text.
Region
United States and Apple's global infrastructure.
Certifications
ISO 27001, SOC 2.
Role
Optional sign-in via Microsoft Identity Platform, and optional Outlook calendar connection for firms.
Data processed
Name, email, profile photo from the openid email profile scopes. Calendar data only if you connect a calendar.
Region
United States and EU (per Microsoft's regional model).
Certifications
SOC 1/2/3, ISO 27001, FedRAMP.
Role
Sends transactional email: sign-in links, invitations, receipts, reminders, and security notices.
Data processed
Your email address and the contents of the message we send you.
Region
United States.
Certifications
SOC 2 Type II, GDPR-aligned DPA.
Role
Electronic signature for firm documents, on an instance we run.
Data processed
The document sent for signature, and the signer's name, email, and signature event record.
Region
United States.
Certifications
Self-hosted by Techno Optics LLC on our own infrastructure.
Role
Alternative electronic signature provider for firms that choose it.
Data processed
The document sent for signature, and the signer's name, email, and signature event record.
Region
United States.
Certifications
SOC 1/2 Type II, ISO 27001, PCI DSS.
Role
Optional meeting links for firms that connect Zoom to their scheduling.
Data processed
Meeting metadata for appointments a firm creates. Meeting contents are not sent to or stored by Taxottic.
Region
United States.
Certifications
SOC 2 Type II, ISO 27001.
Want a Data Processing Agreement (DPA)? See our standard template at /legal/dpa, or write to privacy@taxottic.com.