Security

TaxWize runs entirely on Infomaniak virtual machines in Swiss (Zurich-region) datacenters, including a self-hosted Supabase stack for the database, authentication, and document storage. The runtime is Google-free, with one disclosed exception: the optional "Sign in with Google" button, which processes no tax data.

Full subprocessor detail and the exact scope of what is stored where lives on our data protection page.

Documents you upload are read by an AI model hosted by Infomaniak in Switzerland, together with a self-hosted OCR engine (Tesseract) for scanned pages. Neither is used to train AI models on your data. AI output can be incomplete or imperfect, so extracted values and insights are presented for your review and worth checking before you rely on them.

More on how AI processing works is covered on our data protection page.

We run nightly backups of the production database. Data you delete is removed from active systems immediately. Backups are purged within 30 days.

This matches the retention commitment already stated in our Privacy Policy.

Deleting your data (Settings > Delete all data) permanently removes your declarations, tax computations, extracted facts, uploaded documents, and wealth records. Your account and login stay active, so you can start a fresh declaration afterwards.

Deleting your account (Settings > Delete account) does everything delete-data does, and additionally removes your login identity itself. You are signed out and the account cannot be recovered.

Either action is immediate on active systems. Backups containing the deleted data are purged within 30 days, matching the window described above.

If you believe you have found a security vulnerability in TaxWize, please report it to security@taxwize.ch. We aim to acknowledge reports promptly and appreciate responsible disclosure.

Our disclosure policy is also published at security.txt.