Security at TaxDin
In short
Your travel history is private to your family. Every record is scoped to your family account, passwords are stored only as bcrypt hashes, sessions use signed httpOnly cookies, and password-reset and invite tokens are stored only as SHA-256 hashes that work exactly once.
Account and session security
- Passwords hashed with bcrypt — never stored or logged in plain text
- Signed, httpOnly session cookies; no tokens accessible to page scripts
- Password reset links are single-use, expire after one hour, and only a hash of the token is ever stored
- Family invites work the same way: the secret lives only in the invite email
Data isolation
All residency data is scoped to your family. Backups to Google Sheets are per-family, to a sheet you own and share explicitly with TaxDin's service account — data never mixes across families.
You can delete all of your family's data at any time from the Account dialog; your own Google Sheet backup is untouched, so you stay in control of your history.
Infrastructure and compliance details
Infrastructure and compliance details
Detailed content for this section is being prepared and will be published here soon.
Frequently asked questions
Who can see my family's data?
Only the members and admins of your family account. Admins (for example an assistant or accountant you invite) can view and edit data but are never a tracked person.
Can I get my data out?
Yes — full Excel and CSV export at any time, plus an optional continuous backup to a Google Sheet that you own.
Reviewed by the TaxDin editorial team
Named reviewer credentials will be published here. Last reviewed:
Related resources
Start tracking free
Your history stays yours — export or delete it any time.