Privacy

Two layers. For the firm: your business contact details, your SAIT practitioner number, the staff invited to the organisation. For each client your firm onboards: contact details, 13-digit South African ID, SARS tax reference number, the transactions read from their bank statements, and the supporting documents your firm uploads (IRP5s, certificates, ID documents). Supporting documents are stored as files in Vercel Blob. They are not encrypted, and removing a document does not yet delete its file.

We never request your client's eFiling password or online-banking credentials. Both stay on the client's keyboard, not ours. TaxUp generates the income statement; your firm files the return through its existing channels.

The application runs on Vercel in Frankfurt (fra1). Account data lives in a Neon Postgres database in the EU (currently eu-central-1, Frankfurt), and files are stored in Vercel Blob. OpenAI processes some data through its standard API, which is not hosted in South Africa. Your data does not stay in South Africa.

ID numbers, tax numbers, transaction amounts, descriptions and counterparties are encrypted at the column level with application-layer AES-256-GCM. Names and contact details, finalised return snapshots and uploaded supporting documents are not encrypted this way. The master key lives in Vercel project secrets, not in the source code.

Statements we read successfully aren't stored. We keep the transactions read from them, with amounts, descriptions and counterparties encrypted. The one exception is a file we could not read: it is kept encrypted for 30 days so the failure can be fixed, then deleted.

When our own readers can't read a statement confidently, the whole PDF is sent to OpenAI to be read, including the account holder's name and account number.

Transactions read during client onboarding are held, encrypted, with the onboarding draft.

Changes your staff make inside the workspace (uploads, categorisations, overrides, returns) are recorded in an append-only log scoped to your firm, with timestamp and actor. The database rejects edits and deletions to the log. Viewing records and signing in are not logged.

TaxUp itself doesn't submit anything to SARS. Your firm files returns through its existing eFiling channel using your own SAIT practitioner number; the audit log is evidence of how the underlying books were produced.

We hold the transactions, returns and income statements your firm produces, and the documents it uploads. The third parties that process data for us are:

• Vercel — application hosting and serverless functions (Frankfurt, fra1), and Vercel Blob file storage for supporting documents, client logos and statements we could not read (kept encrypted).
• Neon — Postgres database (currently eu-central-1, Frankfurt).
• Google — sign-in with Google, if you choose it. Google confirms who you are and shares your name, email address and profile picture with us.
• Resend — transactional email (sign-in codes, invitations, billing receipts and account notifications).
• OpenAI — reads statements our own readers can't read confidently (the whole PDF is sent, including the account holder's name and account number); reads tax certificates, SARS assessments and other supporting documents that can't be read from their text (the whole document is sent); categorises the transactions that saved rules and the merchant list don't settle (each transaction's description, amount and date, with the client's business profile and the counterparties already confirmed for that client); drafts a client profile from the account holder's name and a summary of the statement; and answers support chat, using the messages you send. OpenAI's API terms exclude data sent through the API from model training.
• Sentry — error monitoring. Server-side error reports have named sensitive fields (amounts, descriptions, ID and tax numbers) removed before they are sent.
• PayFast — payment processing for firm subscriptions (South Africa).

Each one processes data under its own published terms.

Statement PDFs: not kept once read successfully. A statement we could not read is kept encrypted for 30 days so the failure can be fixed, then deleted.

Onboarding drafts: transactions read during client onboarding are held, encrypted, with the draft. Drafts are not yet deleted automatically.

Derived transactions, returns, audit logs: kept for at least five years, the SARS record-keeping period under the Tax Administration Act. We don't yet delete them automatically after that.

Supporting documents: kept as files in Vercel Blob. Removing a document in the app does not yet delete its file.

Account profile data (name, email, ID, tax number): held while your subscription is active and for at least five years after, so the record across filed years remains complete. We don't yet delete it automatically after that. Removing a client archives it and keeps its data.

You have the right to request a copy of the personal information we hold on you (Section 23), correct anything wrong (Section 24), delete your account (subject to the SARS five-year retention duty for filed returns), and object to processing. Email support@taxup.app and we'll respond inside 30 calendar days.

Inside the app, Data & privacy lets you download a JSON file with your profile, banking details, statement uploads, transactions, returns, your latest 5,000 audit-log entries and preferences. Uploaded documents are not included; ask support for copies. You can also schedule a deletion there, which records your request. Automatic erasure isn't built yet, so email support@taxup.app to complete it. Audit-log entries are append-only and are kept in full.

In the event of a breach affecting your personal data, we notify you and the Information Regulator of South Africa within 24 hours of confirmation.

Under POPIA, TaxUp's Information Officer is the founder, reachable at support@taxup.app. The Information Officer's name and the operating entity will be updated here once the Pty Ltd is incorporated.