GoRefer Trust Center
Data Protection
Updated September 2026
GoRefer applies multiple layers of data protection, with particular emphasis on sensitive PII fields used in tax workflows. This page details our field-level encryption, key management practices, and data minimization controls.
Encryption at Rest
Updated September 2026
Database Encryption
MongoDB Atlas Encryption at Rest
Storage encryption is provided by MongoDB Atlas and depends on our Atlas settings; details on request
Volume encryption
Disk encryption is an infrastructure setting; details on request
Backup encryption
Backup encryption, location and retention are separate from field encryption; details on request
Field-Level Protection
Additional encryption on sensitive fields
Supported sensitive intake fields are encrypted inside the application before they are stored
Defense-in-depth
Field encryption adds a separate layer on top of the storage protection our providers manage. It does not stop authorized parts of the application from decrypting data.
Keys isolated from data
The application reads its encryption key from configuration, not from the database; how the key is stored and who can access it is available on request
What We Encrypt
Updated September 2026
The following fields are encrypted in supported intake forms. This is separate from the storage encryption our providers manage. Uploaded documents and other copies of the same information are not covered by field encryption and rely on their own handling and access controls.
| Sensitive Data | Protection Method | Who Can Access |
|---|---|---|
Social Security Number (SSN) | AES-256-GCM (field-level) | Authorized firm admins/preparers; system processing |
Employer Identification Number (EIN) | AES-256-GCM (field-level) | Authorized firm admins/preparers; system processing |
Bank Account Number | AES-256-GCM (field-level) | Authorized firm admins/preparers |
Bank Routing Number | AES-256-GCM (field-level) | Authorized firm admins/preparers |
Driver License Number | AES-256-GCM (field-level) | Authorized firm admins/preparers |
Payment Card | Tokenized by Stripe — never stored on GoRefer servers | System only (via Stripe) |
Sensitive data access is scoped and audited
Standard views mask sensitive fields. Authorized admins and preparers can open decrypted intake data for an assigned client, including through AutoFill. In supported apps the user must re-enter their password before a specific client's sensitive data is shown, and those reads are audited. This restricts access; it does not mean decrypted data never leaves GoRefer's servers.
Key Management
Updated September 2026
Key Storage & Rotation
Encryption keys are stored separately from the data they protect
The application loads its encryption key from configuration when it runs
Environment separation and key-access policy: details on request
Key changes require a controlled migration and recovery procedure
Changing the key does not automatically re-encrypt existing records
Who Can Access Keys
Our policy limits production key access to authorized operations staff and the running application
Key-access approvals: records on request
Logging of key access depends on how secrets are stored; details on request
Our operations team is responsible for key-access procedures
Data Minimization & Pseudonymization
Updated September 2026
Data Minimization
Only fields required for the tax workflow are collected
Optional PII fields (DL number) collected only when explicitly provided
Analytics data and identifiers differ between the website and the app; see the Cookie Policy
Gio case context redacts sensitive identifiers; names and narrative may remain
Authorized exports can include sensitive client data; protect downloaded files
Pseudonymization Practices
First-party analytics use visitor, session or user identifiers depending on where they run
Error tracking (Sentry) configured to scrub PII from stack traces
Log filters reduce the personal data kept in logs; details of log contents and retention on request
Product screenshots on our website use fictional demonstration data; details of test-environment data practices on request