TaxWeave security and AI processing

Two AI processing paths

Client documents are read by a model TaxWeave operates in its private cloud. This document-processing step is separate from requests to outside AI model APIs.

For research and drafting that use outside models, identifying details are replaced with placeholders before the request leaves TaxWeave. These include Social Security numbers, EINs, ITINs, bank and routing numbers, and W-2 control numbers. Outside-model requests are checked again before sending; a request still containing an identifier is not sent. Real values are restored only inside TaxWeave.

Infrastructure and outside providers

Private-cloud processing still runs on infrastructure. It does not mean that client documents never reach a hosting provider. Contact sam@taxweave.ai for the current document-processing infrastructure-provider details before onboarding.

The privacy policy lists Supabase, Vercel, Railway, Resend, Google, and outside-model providers Anthropic and OpenAI, with their roles. Outside-model APIs receive identifier-removed requests as described above.

Client information is not training data

Client information is not used to create, train, or improve AI models, ours or anyone else’s. Outside AI providers are accessed through commercial APIs whose terms prohibit training on submitted data. Processing documents to provide the service is distinct from training models.

Connections and access controls

Current connections are Gmail, Outlook, Google Drive, OneDrive, Google Sheets, and CSV upload. Connections require authorization from the firm. Revoke a connected data source in TaxWeave to stop new data flowing from it.

TaxWeave maintains access controls and encryption in transit and at rest. The privacy policy describes the Google scopes and their read-only or selected-file limits. Request configuration-specific details during onboarding.

Retention and deletion

The privacy policy states that data is retained while an account is active, removed from live systems within 14 days following termination or a deletion request, and purged from backups within 90 days. Send account deletion requests to sam@taxweave.ai.

Your firm remains responsible for its own required records. Review the current privacy policy and your agreement for the applicable terms.

Human review and current assurance status

AI drafts work for your firm to review. TaxWeave currently prepares 1040 workpapers; your firm completes and files the return in its existing tax software. Completed-return review is in development.

SOC 2 is in progress. TaxWeave does not claim a completed SOC 2 audit. This page describes the software and published commitments; it does not determine a firm’s taxpayer-consent or legal obligations.