GoRefer Trust Center
Security
Updated October 2026
About this page. This page describes how GoRefer works today. It is not an independent audit or a contractual service level. For questionnaire answers, or for documents we share under NDA, make a request through the Trust Portal.
This page describes the security controls built into GoRefer. GoRefer maintains a written information security program, and firms can request it under NDA for their own security review.
Encryption in Transit
Updated October 2026
GoRefer's website, web app and API use HTTPS. We use HTTPS everywhere, standard browser security headers, and rate limits on sign-in and the API.
Transport Security
HTTPS for the website, web app and API
Browsers are told to use HTTPS only
Certificates from trusted certificate authorities
Scope of Coverage
Requests from your browser to GoRefer, over HTTPS
Connections to our service providers, over HTTPS
Private files are shared through links that expire
Encryption at Rest
Updated October 2026
Sensitive fields are encrypted with AES-256-GCM inside the application before they are stored. Our hosting providers also encrypt stored data by default, and nightly database backups are encrypted before upload.
Field-Level PII Encryption
Updated October 2026
Supported sensitive fields are encrypted inside the application before they are stored. Reading them requires GoRefer's encryption key; authorized parts of the application can decrypt values for their permitted purpose.
Supported intake fields use AES-256-GCM. Field encryption is separate from storage encryption and does not mean that every document, log entry or personal-data field is encrypted individually.
Standard views mask sensitive fields. Authorized admins and preparers can open decrypted intake data for permitted work, including AutoFill, and each such access is audited.
| PII Field | Protection | How It’s Stored |
|---|---|---|
| Social Security Number (SSN) | AES-256-GCM (field-level) | Encrypted in supported intake fields |
| Employer Identification Number (EIN) | AES-256-GCM (field-level) | Encrypted in supported intake fields |
| Bank Account Number | AES-256-GCM (field-level) | Encrypted in supported intake fields |
| Bank Routing Number | AES-256-GCM (field-level) | Encrypted in supported intake fields |
| Driver License Number | AES-256-GCM (field-level) | Encrypted in supported intake fields |
Authentication & Identity
Updated October 2026
Session Security
Sessions are short-lived and can be revoked
Signing out or changing your password ends your other sessions
Every request is checked against your role and your firm
Two-Factor Sign-In
Two-factor sign-in is required for firm admins, and your firm can require it for preparers. The code comes by email or from an authenticator app. A device you choose to trust can skip the code for 30 days.
GoRefer staff use two-factor sign-in for our administration tools
Repeated failed sign-ins lead to a lockout
Passwords must be at least 12 characters and are checked against known breaches
Security Hub & Monitoring
Updated October 2026
Security Hub is a platform-operations workspace protected by platform permissions. It provides security events, session information, threat records and audit tools for authorized operators. It is not a dashboard included with a tax firm subscription.
Security Hub Features
Platform security health summary based on recorded signals
Threat alert records and supported detection checks
IP blocklist — manually or automatically block known bad actors
Active session listing with device/browser/IP metadata
Session revocation (individual or all-device logout)
Administrative assistance sessions with start/stop audit records
Audit Logging
Workflow-specific events for authentication, selected data operations and administration
Log fields: actor (user ID, email, role), timestamp, IP, user-agent, resource, action, outcome
Integrity checks on security audit records
Retention varies by log and workflow; see Data Retention
Authorized audit-record exports for further review
Security event categorization for internal review
Secure Development Practices
Updated October 2026
Code & Input Safety
Input validation and sanitization tailored to each part of the API
Structured database queries, with query validation for each part of the API
File uploads are checked by type, content and size, not just by file extension
Automated dependency checks run in our build pipeline; no automated check can prove a release is free of vulnerabilities
Private files download through signed links; public branding and marketing assets follow different access rules
Access & Operations
Access to production systems is limited to the people who run the service
GoRefer staff tools require two-factor sign-in and role checks
Staff actions in our administration tools are logged
To report a vulnerability, see Vulnerability Disclosure.
Security Incidents
Updated October 2026
GoRefer maintains a written incident response plan. See Incident Response for how we notify your firm, and Network Security for how connections are protected.