Security at Taxy

Last updated: 28 September 2026.

Taxy holds some of the most sensitive information your practice has: your clients’ identities, their finances, their tax affairs. Here’s how we look after it.

Your data is stored in Australia

The data in your Taxy account, including backups, is stored in Australia on Google Cloud. Some of the services we use to run Taxy are located overseas. Our Sub-processor list names each one and the information it handles, and our Privacy Policy explains how we manage it.

Encrypted, always

Your data is encrypted while it travels and while it sits on disk.

Who can get to your data

Every Taxy account can use multi-factor authentication. Our own staff accounts always do.

The accounts we use for email and everyday work can’t reach the Google Cloud systems your data is stored in. Getting in takes a separate account, and day to day that means a physical security key. A key can’t be phished: there’s no code to read out, and nothing to type into a fake login page. Every time someone signs in to one of those accounts, an alert goes out. Access is limited to what the job needs, and it’s logged.

Built to stay online

Taxy runs on Google Cloud’s managed infrastructure in Australia. We keep written plans for staying online through a disruption and for handling an incident.

How we use AI

We use AI tools from Anthropic to develop, operate and support Taxy. Where that work involves information in your account, Anthropic processes it on our behalf. Model training is turned off, so your information isn’t used to train Anthropic’s models. Anthropic is on our Sub-processor list.

If and when we build AI features into Taxy itself, they’ll use Google Cloud’s models, run in our Australian Google Cloud environment, and your data won’t be used to train them.

How we work

We run a documented information security management system: written policies, security training for our team (most recently in April 2026), and checks on our vendors (we look for ISO 27001 or SOC 2).

Want the detail? Ask us for our security questionnaire — security@taxy.au.

Report a concern

Found a security problem? Email security@taxy.au.

We welcome good-faith reports from security researchers. Report something responsibly, give us reasonable time to fix it before you make it public, and we won’t take legal action against you over that research. While you’re testing, please don’t access, modify or delete customer data, or degrade the service.