Security and IRS e-file status

Draft for attorney review before launch.

IRS e-file provider status

Transmitting Form 990-series returns to the IRS requires Authorized IRS e-file Provider status (EFIN and ETIN) and completion of Modernized e-File assurance testing.

Not yet certified. File990Now is not currently an Authorized IRS e-file Provider and holds no EFIN or ETIN. Transmission is disabled: a return prepared here is validated and can be downloaded, but it is not sent to the IRS, and you remain responsible for filing it by another route until this page says otherwise.

How your data is protected

What is in place today:

• Passwords are stored as salted scrypt hashes and are never visible to staff.
• Payment card details are entered directly into our payment processor and never reach our servers.
• Return data is encrypted at rest by our database provider, and in transit over TLS.
• Every change to a return’s status is written to an append-only event log, recorded in the same transaction as the change itself.
• Staff access to customer data is recorded in an append-only audit log, along with every sign-in, failed sign-in and support impersonation. Nothing in the application updates or deletes those rows.
• Support impersonation is explicit: it expires after 30 minutes, is visible to the person being helped as a banner on every page, and cannot be used against another staff account.
• Sign-in is rate limited by both email address and IP, so a stolen password list cannot be walked across accounts.
• Two-factor authentication is available on every account, with single-use recovery codes.
• Data has a retention period rather than being kept indefinitely, and the periods below are the ones the deletion job reads.

How long we keep things

• failed authentication attempts: 1 day
• spent or expired treasurer invites: 30 days
• email delivery events: 2 years
• watchdog incidents: 1 year
• audit trail: 7 years — deleted only on a deliberate instruction, never on a schedule
• returns and their event log: 7 years — deleted only on a deliberate instruction, never on a schedule

Unsubscribe records are the deliberate exception and have no expiry. Deleting one would resume mailing somebody who asked us to stop, which is the one thing that list exists to prevent.

What is not in place yet, and is required before launch:

• An independent security assessment. No penetration test or SOC 2 examination has been carried out.

This list is deliberately specific. Security pages that describe intentions in the present tense are how customers end up misinformed; anything above that moves will be moved here rather than quietly reworded.

Questions about any of this: support@file990now.com.