Effective July 28, 2026 · Updated October 14, 2026
TaxWeave is the context layer tax firms run on. It holds everything your firm knows about a client and puts skills to work on top of it. TaxWeave is built and operated by TaxWeave, PBC, based in Richmond, Virginia.
When you connect an account to TaxWeave, we access data from the tools your firm already uses — including but not limited to email (Gmail, Outlook), document drives (Google Drive, OneDrive), and client lists supplied through CSV upload or Google Sheets. ShareFile and Dropbox are not listed as currently supported connections. Other integrations are in development.
You will be notified when new integrations become available, and each connection requires your explicit authorization before any data is accessed.
We use your data solely to provide the TaxWeave service — surfacing engagement intelligence and practice insights within the product. We do not sell your data, share it with third parties for marketing purposes, or use it for any purpose beyond delivering the service to you.
When you connect a Google account, TaxWeave requests the narrowest Google OAuth scopes that support the features you turn on:
TaxWeave’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Google user data is used only to provide the user-facing features described above. It is never sold, never used for advertising, and never used — in raw, aggregated, anonymized, or derived form — to create, train, or improve any machine learning or artificial intelligence model, whether ours or a third party’s. Client documents are processed by a model TaxWeave operates in its private cloud. Outside AI providers receive requests through their commercial APIs, with identifiers removed as described below; their terms prohibit training on submitted data. You can revoke TaxWeave’s access at any time from TaxWeave’s settings or from your Google Account permissions page.
TaxWeave uses two processing paths. Client documents are read by a model TaxWeave operates in its private cloud. For research and drafting that use an outside model, identifying details are detected and replaced with placeholders in code — Social Security numbers, EINs, ITINs, bank and routing numbers, and W-2 control numbers among them. Every outside-model request is checked again on the way out, and a request still containing an identifier is not sent. Real values are restored only inside TaxWeave. The private-cloud document-processing path and the outside-model path are distinct; the identifier-removal statement describes requests to outside models. See the security and AI processing page for the data flow.
This design exists because IRC §7216 and Rev. Proc. 2013-14 govern a preparer’s disclosure of taxpayer return information to third parties. TaxWeave is built so that outside-model requests contain placeholders in place of detected identifying details. This is a description of how the software works, not legal advice about your own obligations — consult your own counsel regarding consent requirements that apply to your firm.
TaxWeave runs on third-party infrastructure and service providers, including but not limited to:
These providers maintain industry-standard security practices, and this list may change as the product evolves. You acknowledge that your data is processed on distributed infrastructure maintained by these third parties.
We retain your data for as long as your account is active. Following termination or a deletion request, data is removed from live systems within 14 days and purged from backups within 90 days. Note that your firm has its own record-retention obligations as a preparer; TaxWeave is not a system of record for those purposes, and you remain responsible for retaining what you are required to retain.
We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the data we handle, including access controls, encryption in transit and at rest, and the identifier-removal architecture described above.
If we become aware of a security incident affecting your data, we will notify you without undue delay and no later than 72 hours after becoming aware of it. Notification will describe what we know, what we are doing about it, and what you may need to do.
You may revoke access to any connected data source at any time. Revoking an integration stops the flow of new data from that source immediately.
Full deletion of your account and associated data requires written notice to sam@taxweave.ai. Please allow a minimum of 14 days from receipt for us to execute it.
TaxWeave is currently in early access. The service is provided as-is and may change. This privacy policy will be updated as the product evolves.
TaxWeave, PBC
sam@taxweave.ai