Security
Passwords are hashed. Sessions are httpOnly, 12-hour JWTs.
Documents are stored privately with signed URLs. They are not written to application logs.
PAN and Aadhaar are excluded from analytics metadata.
Income Tax portal credentials are never collected.
Role-based access: USER, TAX_PROFESSIONAL, ADMIN.
2FA fields exist on the user record for a later TOTP rollout.
Document deletion controls are available via storage.delete.
TaxPilot AI is an independent tax preparation software and is not affiliated with or endorsed by the Income Tax Department. Tax calculations and return preparation are provided as software assistance and should be reviewed by the taxpayer or a qualified tax professional before filing.