Dfensible
Security and trust
Last updated September 7, 2026
Dfensible holds tax returns, W-2s, 1099s, K-1s and closing statements that clients entrust to their tax professional. This page says plainly how that data is protected, who else touches it, and how to reach us if you find a problem. It avoids claims we cannot back with evidence.
Separate by design
- Client documents live in a storage bucket dedicated to this product, with its own encryption key (rotated annually), its own access credentials, its own malware scanner and its own access logs. Nothing is shared with any other product.
- Every record belongs to a practice, not to a person. A member leaving a practice takes nothing with them.
- Clients never need an account. They use a private link plus a one-time code emailed to them; the link can be rotated or revoked by the practice at any time.
How data is protected
- Encrypted in transit (TLS, HSTS preloaded) and at rest. Documents use a customer-managed encryption key.
- Every uploaded document is malware-scanned within seconds; a flagged file can never be read, even by us.
- Every request authenticates and every read is scoped to one practice and one client. Each read of a client's file is logged with the member who made it and kept for one year.
- Uploads are checked by content, not by file name: a file that is not what it claims to be is rejected. Limits: 10 files at a time, 20 MB each.
- Our AI prompts are instructed never to extract Social Security numbers, EINs or full account numbers; readings are estimates the professional reviews row by row before anything is saved.
- Multi-factor sign-in is available on every professional account. Nightly encrypted database backups are stored in two regions.
Who else processes data
We use a small number of established infrastructure providers, each reviewed before integration and re-reviewed annually, and each bound by a data-processing agreement. The categories are below; a named list with each provider's certifications is available to any practice on request at security@nestworthy.ai.
| Category | Purpose | What it holds |
|---|---|---|
| Cloud storage and key management | Document storage, encryption keys, malware scanning | Client documents, encrypted with a customer-managed key dedicated to this product |
| Managed database | Records | Practice, client and profile records, encrypted at rest |
| Application hosting | Serving the app and its API | Requests in transit; no stored customer data |
| Identity provider | Professional sign-in and multi-factor | Email, name, sign-in method of practice members |
| AI model provider | Document reading | Document contents sent for a reading under a no-training agreement |
| Transactional email | Email delivery | Email addresses and message content (portal links, one-time codes, notices) |
| Error monitoring | Crash and error reports | Error reports, configured to exclude personal data |
| Product analytics | Usage measurement | Anonymized usage events |
Independent verification
Dfensible is not yet SOC 2 certified. An independent penetration test is planned; results are posted here when issued, with the assessor named. We do not describe our security as “bank-level” or records as “audit-proof” — nothing is.
Report a vulnerability
Email security@nestworthy.ai. We acknowledge within two business days, keep you informed, and do not pursue researchers who test in good faith, avoid other practices' data, and give us reasonable time to fix.
Dfensible, a Nestworthy.ai company, is software for tax professionals, operated by Nestworthy Inc. It does not give tax, legal or financial advice; the professional using it is responsible for every determination.