Encrypted in transit and at rest
All traffic runs over TLS. Stored threads, uploads and firm records are encrypted at rest by the managed database and storage layer.
Security
Client data deserves the same care as the return it supports.
You are bound by Circular 230 and §7216. The tooling you use has to respect that, so confidentiality is a design constraint here, not a checkbox.
Your content is not training data
Firm threads and uploaded documents are used to answer your questions and nothing else. They are not used to train or fine-tune any model.
Retention you control
Delete a thread or document and it is removed from active storage. Firm owners can set a retention window so material ages out automatically.
Scoped access by firm
Row-level access rules mean a user can only read records belonging to their own firm. Owners manage who holds a seat and what role they have.
Being straight with you
Pecos Tax is early. We are not yet SOC 2 certified, and we say so rather than implying otherwise. If your firm requires a completed security review before adoption, contact us and we will share our current controls documentation and roadmap.