Review the boundaries before the first file.
Tepin is being built for workflows that may involve sensitive tax data, so no firm should rely on marketing copy alone. Before a supported workflow uses client data, we review the proposed architecture, data path, hosting, subprocessors, access, retention, and incident process. Scope and commitments are documented before client data is considered.
The review identifies the data categories needed for the agreed workflow, where they travel, retention and deletion expectations, and which protections are proposed. Encryption, masking, or redaction are assessed for that scope; this page does not claim that any treatment applies universally.
We review the proposed tenant model, authorization path, role boundaries, and administrative access for the supported configuration. Firm-specific commitments belong in the agreement and supporting evidence; public copy is not a substitute for an isolation review.
For any supported workflow that uses AI, the security review identifies the data fields involved, providers, transformations, and retention expectations. A firm can decline a scope that does not meet its requirements; client data should not enter the workflow before the scope is accepted.
Tepin may support drafts and reviewer handoffs within an agreed scope. Your firm retains review, sign-off, client-send, and filing authority. Its existing tax engine remains the filing system.
The security review identifies which events a proposed workflow is expected to record and what evidence the firm can inspect. We do not represent universal audit coverage or an examination-ready trail; required event evidence must be agreed and verified before use.
Authentication, role access, session controls, and offboarding needs are reviewed with each firm. SSO and MFA are not represented as generally available; if either is required, that requirement must be resolved before access.
The proposed hosting provider, region, data-residency path, and subprocessors are reviewed for the supported configuration. No public promise of a particular cloud, United States residency, or cross-border option applies without a documented agreement.
Tepin does not currently claim a SOC 2 report or another third-party security certification. The fit and security process establishes what evidence is available and whether the proposed workflow is appropriate for the firm. Public posture changes only after the supporting evidence exists.
Reporting a security issue
The verified security contact will be published before submissions open. Until then, do not use this site to submit a security report or taxpayer or client data.