Security at Ascend Taxes
This page is organized by what you actually do: sign in, upload, use AI, share a bank, and leave. It says what the product code and schema files show. It does not borrow another company’s audit badge.
Last reviewed: not set. The publish date and review cadence are an open decision.
Signing in
Two-factor authentication is available and is not on unless you turn it on. In the portal, open Settings and choose Turn on two-factor. You scan a code with an authenticator app. It is not required for every client today.
The site file site/_headers sets Strict-Transport-Security. Live Netlify was not re-checked for this page. The netlify.toml header fallback does not repeat Strict-Transport-Security. site/_headers is the file that sets it.
Uploading documents
deploy/setup.sql marks the documents and chat-images buckets public = false. The live bucket setting was not opened. An Ascend admin account can open client documents. This page does not say only you can see them.
Document preview and download links in the current portal code last 600 seconds (ten minutes). Chat attachment links last 3600 seconds (one hour). A new link is created when you open a file again.
Every public table declared in deploy/setup.sql and supabase/migrations enables row-level security in those files. The live database was not queried.
Encryption at rest is not claimed. Supabase plan and region are not stated here. They were not read from the live project.
When AI is used
Document reading, the in-portal assistant, bank-transaction labels, and advisor phrasing can send information to Anthropic. The preparer reviews the return. The assistant does not file.
Anthropic retention for this firm is not stated as zero data retention. That arrangement was not confirmed.
Who else handles data
These companies process data for Ascend. Their own security pages are theirs. This page does not present their audits as Ascend certifications.
| Who | Role |
|---|---|
| Supabase | Sign-in, database, file storage, and server functions. |
| Netlify | Hosts this website. |
| Anthropic | Model provider for document reading, the assistant, bank-transaction labels, and advisor phrasing. |
| Plaid | Bank connection, only after you connect a bank. |
| Resend | Sends email. |
| Stripe | Takes card payments. |
| Twilio | Sends text messages. |
Bank linking goes through Plaid. The server default in code is sandbox when PLAID_ENV is unset. This page does not call that a live production bank connection.
Leaving
There is no “download my whole account” or “delete my account” button on this page. Consent-ledger rows are kept when you withdraw a purpose. A backup copy aging out is an operations fact, not a promise about how long your tax records are kept.
Contact
Write hello@ascendtaxes.co. A dedicated security mailbox is not published — that address is an open decision.