GoRefer Trust Center
Security
Updated September 2026
About this page. The procedures and recovery times described here are our policies and targets. They are not an independent audit, a contractual SLA or proof that a scheduled review has taken place. For current details, assessment reports and records, make a request through the Trust Portal.
Security is a foundational pillar of the GoRefer platform — not a compliance afterthought. This page describes the security controls built into GoRefer and the documents your firm can request for its own security review.
Encryption in Transit
Updated September 2026
GoRefer's website, web app and API use HTTPS. TLS versions, certificates and the connections between our internal services vary by service; if your security review needs those details, ask us.
Transport Security
HTTPS for web app and API connections
HSTS headers tell browsers to use HTTPS only
TLS versions and key exchange: details on request
Cipher policy and certificate chain: details on request
Certificates are managed for each service through its hosting provider
Scope of Coverage
Requests from your browser to the GoRefer API, over HTTPS
Webhook and OAuth connections follow each provider's transport settings
Private files are shared through signed links; public assets follow separate access rules
Connections between internal services: details on request
Database connection encryption: details on request
Encryption at Rest
Updated September 2026
Sensitive fields are encrypted with AES-256-GCM inside the application. Encryption of the underlying storage is set with each hosting provider; details for each layer below are available on request.
| Storage Layer | Algorithm | Key Management | Notes |
|---|---|---|---|
| MongoDB database storage | Hosting provider setting | Hosting provider settings | Encryption and key-management details on request |
| AWS S3 file storage | Storage bucket setting | Bucket and provider settings | Encryption, public-access and versioning details on request |
| Database backups | Backup setting | Backup provider settings | Backup encryption details on request |
| Server disk storage | Server setting | Server operating system | Some features can store files on the server's own disk; details on request |
Field-Level PII Encryption
Updated September 2026
Supported sensitive fields are encrypted inside the application before they are stored. Reading them requires GoRefer's encryption key; authorized parts of the application can decrypt values for their permitted purpose.
Supported intake fields use AES-256-GCM; records encrypted with our earlier method remain readable. Field encryption is separate from storage encryption and does not mean that every document, log entry or personal-data field is encrypted individually. AES-256-GCM also detects tampering with the encrypted value.
Standard views mask sensitive fields. Authorized admins and preparers can open decrypted intake data for permitted work, including AutoFill, and each such access is audited.
| PII Field | Protection | How It’s Stored |
|---|---|---|
| Social Security Number (SSN) | AES-256-GCM (field-level) | Encrypted in supported intake fields |
| Employer Identification Number (EIN) | AES-256-GCM (field-level) | Encrypted in supported intake fields |
| Bank Account Number | AES-256-GCM (field-level) | Encrypted in supported intake fields |
| Bank Routing Number | AES-256-GCM (field-level) | Encrypted in supported intake fields |
| Driver License Number | AES-256-GCM (field-level) | Encrypted in supported intake fields |
Authentication & Identity
Updated September 2026
Session Security
Short-lived session tokens — minimizes exposure if a token is intercepted
Browser refresh cookies use HttpOnly; access tokens are available to the application in memory
Logout and credential changes revoke applicable refresh sessions; access-token expiry remains separate
Signed access tokens carry firm context, with role and firm checks on supported requests
Refresh tokens are hashed in the server session store
Multi-Factor Authentication
TOTP-based MFA — compatible with Google Authenticator, Authy, 1Password
Backup codes generated on MFA enrollment, stored securely
Privileged sign-ins include two-factor checks; our staff security policy is available on request
Brute force protection: automatic lockout after repeated failed attempts
Password minimum: 8 characters
Security Hub & Monitoring
Updated September 2026
Security Hub is a platform-operations workspace protected by platform permissions. It provides security events, session information, threat records and audit tools for authorized operators. It is not a dashboard included with a tax firm subscription.
Security Hub Features
Platform security health summary based on recorded signals
Threat alert records and supported detection checks
IP blocklist — manually or automatically block known bad actors
Active session listing with device/browser/IP metadata
Session revocation (individual or all-device logout)
Administrative assistance sessions with start/stop audit records
Audit Logging
Workflow-specific events for authentication, selected data operations and administration
Log fields: actor (user ID, email, role), timestamp, IP, user-agent, resource, action, outcome
A separate integrity check for chained audit records
Retention varies by log and workflow; see Data Retention
Authorized audit-record exports for further review
Security event categorization for internal review
Secure Development Practices
Updated September 2026
Code & Input Safety
Input validation and sanitization tailored to each part of the API
Structured database queries, with query validation for each part of the API
File uploads are validated by type, content, and size — not just file extension
Automated dependency checks run in our build pipeline; no automated check can prove a release is free of vulnerabilities
Private files download through signed links; public branding and marketing assets follow different access rules
Access & Operations
Principle of least privilege for all internal accounts and service roles
Production network and staff-access restrictions: details on request
Our secrets policy requires credentials to be kept out of source code
Secrets reach the running application through configuration; how they are stored is available on request
Platform administration uses privileged authentication and role checks
For penetration testing details, see Penetration Testing. To report a vulnerability, see Vulnerability Disclosure.
Security Incident History
Updated September 2026
Request the current incident record
We keep a record of security incidents and their impact on customers. Contact security@gorefer.io for the current record.
Our process is to record security incidents, near-misses and service disruptions through the Incident Response process and review each one afterwards. You can request the current incident register and completed reviews.
HTTP Security Headers
Updated September 2026
GoRefer serves a comprehensive set of security response headers. Security reviewers can verify these independently using tools such as securityheaders.com.
| Header | Protection | Status |
|---|---|---|
Strict-Transport-Security | Tells browsers to use HTTPS only, with a long-lived HSTS policy | Enforced |
Content-Security-Policy | Restricts allowed script, style, and media sources — primary XSS mitigation | Enforced |
X-Frame-Options | Restricts framing on covered pages; public embeds have different rules | Set per page |
X-Content-Type-Options | Disables MIME-sniffing — prevents content type confusion exploits | nosniff |
Referrer-Policy | Prevents full URL from leaking to cross-origin sites via the Referer header | Enforced |
Permissions-Policy | Controls browser capabilities according to each page's policy | Enforced |
Cross-Origin-Opener-Policy | Controls cross-origin window relationships where configured | Set per page |
For full network security details including WAF, DDoS protection, and rate limiting, see Network Security.