FileDeskSecurity
You are holding other people's tax logins. That deserves care.
A tax practice keeps the keys to its clients' financial lives. FileDesk is built on that assumption rather than adding security afterwards. Here is exactly what happens to your data — in plain language, with nothing hand-waved.
Credentials
How a client's portal password is stored
Encrypted before it is written
AES-256-GCM, applied in the application before the value reaches the database. A person reading the raw database sees ciphertext, not passwords.
A separate key per field
Username, password and PIN are each encrypted under their own key, derived with HKDF-SHA256, so one record's initialisation vector is never reused under the same key.
Never logged, never broadcast
Credential values never appear in logs, never travel in realtime events, and are never included in list responses. They are fetched only when explicitly requested over an authenticated channel.
Re-encrypted on the device
Inside the branch extension they are stored again under a key belonging to that installation, and decrypted only at the moment a login form is filled — then dropped from memory.
The master encryption key lives only on your server, in a root-owned file. It is not in the source code, not in the repository, and not held by anyone else.
Isolation
One agency can never see another
Every query is scoped by the agency on your server-side session — never by anything the browser sends. This is verified by an automated suite in which one agency actively attacks another using real record identifiers.
Scoped at the source
Client, case, ledger and credential reads all carry the tenant filter in the query itself. A foreign identifier returns "not found" — it does not even confirm the record exists.
Writes refused too
Editing a client, setting credentials, closing a case, resetting a branch password: attempted across agencies, every one is rejected.
Roles enforced server-side
A branch cannot reach owner-only screens even by typing the address. Obscurity is never the boundary.
Access
Who is signed in, on what, right now
Passwords hashed with Argon2id
The memory-hard algorithm recommended for password storage. Plaintext passwords are never stored, and a failed sign-in never reveals whether the username exists.
One live session per surface
An account has one active web session and one active extension session. Signing in elsewhere ends the previous one and says why — shared logins become visible instead of silent.
Registered devices
Each extension installation is registered against a licence. One active device per account; moving machines requires the owner to revoke and approve a replacement.
Throttled sign-in
Repeated failures are rate limited per account and per address, with a generic failure message so an attacker learns nothing from the response.
The extension
Deliberately small
Only the portals you approve
It runs on the specific tax-portal hostnames configured for your agency — never on every website you visit. Adding a portal requires a new build.
Two fields, never the CAPTCHA
It fills the identifier and the password. It will not touch a CAPTCHA or an OTP field, and refuses if a selector points at one.
Not in the Chrome Web Store
Distributed directly to your agency, so you always know which builds and which machines exist.
Your data
Where it lives, and how it comes back
On your own server
FileDesk runs on infrastructure you control. There is no shared multi-customer cloud holding your clients' credentials alongside somebody else's.
Encrypted backups
Scheduled database dumps encrypted with age, including a key-recovery package, so a backup is restorable and useless to anyone who steals it.
Nothing sold, nothing shared
No analytics on client data, no third-party processors, no advertising identifiers. The marketing site you are reading loads no external scripts and sets no cookies.
Deactivate, don't delete
Clients are deactivated so financial history stays intact, while stored credentials can be removed at any time without touching that history.
Want the detail?
Ask for the architecture and authentication notes. Technical questions get technical answers.