How we protect your data
Tax data is a record. We describe the controls we actually run, and name the ones we do not.
Where your data lives
The question every accountant asks first, answered plainly.
Hosting
Your data is stored in the European Union (Ireland), on AWS infrastructure operated by Supabase. It does not sit in the UAE today. We would rather tell you that than imply otherwise.
Transfers
Where data leaves the UAE it goes only to providers contractually bound to protect it to a standard consistent with the UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021.
Sub-processors
Named in full on the Privacy page — Supabase, Vercel, Anthropic, Sentry and Ziina — not hidden behind the phrase “trusted partners”.
Data protection
Encryption
Encrypted in transit with TLS, and at rest with AES-256 by the hosting provider.
Separation between accounts
Every row carries the account that owns it, and the separation is enforced inside the database rather than in application code. One account cannot read another’s rows even if the app has a bug.
Files
Uploads sit in private storage that is not publicly reachable. Links are generated on demand and expire within a minute.
The audit trail
What is recorded
Every change to a return, every computation and every refusal is appended with who did it and when.
Tamper-evident
The trail is append-only and chained, and can be re-verified on demand — a broken link in the chain is detectable, not silent.
Backups
The hosting provider takes automatic daily backups. We have not yet rehearsed a full restore end to end; when we have, this line will say so.
What we do not claim
Three things that often appear on a page like this, which we cannot honestly put on ours yet.
UAE data residency
Not available today. If your policy requires data to remain in the UAE, tell us before you subscribe rather than after.
One-click export
You can print and download a return. A self-serve export of an entire account is not built yet — ask and we will produce it by hand, in an open format, at no charge.
Certification
We hold no ISO 27001 or SOC 2 certification. When a vendor claims one, ask for the certificate number and the scope statement.
Security We describe controls specifically and avoid unverifiable claims. If anything here is wrong or out of date, write to info@taxcheck.ae and we will correct it.
See your risks before the FTA does
Run the free risk check, or bring your latest return data to a 30-minute demo.