Trust Center
Paperwork Labs LLC builds FileFree, tax filing software for individuals, and Distill, tax software for professional preparers. This page explains the security program that protects taxpayer data across every product, what is still in progress, and how to request supporting documentation.
Who we are
Paperwork Labs LLC is a California company. One security program covers every product. FileFree is an Authorized IRS e-file Provider; electronic filing opens once IRS assurance testing is complete.
Documents on request
EV certificate confirmation, vulnerability scan attestations, and the WISP summary.
Already have a document access code? Open your documents.
Security measures in place
Extended Validation TLS certificate
Every public FileFree hostname serves an organization-vetted EV certificate: the web app since August 11, 2026, and the API since August 22, 2026. A weekly job checks every certificate's chain and expiration.
External vulnerability scanning
A PCI Approved Scanning Vendor scans our public systems every week. Recorded scans from August 15, 2026 passed on both entry points.
Bot and abuse protection
Challenge-response protection is built into FileFree's public document-upload and filing-submission endpoints, guarding against bulk automated abuse.
Written Information Security Program
We operate under a WISP covering the FTC Safeguards Rule, active since August 5, 2026, overseen by a designated Qualified Individual. One company runs the security program across FileFree and Distill.
Encryption at rest
Sensitive filer identity data, including Social Security Number, legal name, address, and date of birth, is encrypted at rest with field-level encryption.
Row-level security
Every tenant-scoped table enforces row-level security at the database layer. A request can only read the data it owns.
Immutable access logging
Every decryption of a Social Security Number or legal name writes an audit entry recording who accessed it and why. That log cannot be altered or deleted.
AI and your Social Security number
We never send your Social Security number to the AI model that helps fill out your return.
In progress
Work that remains before the program is complete.
TRUSTe privacy certification
Underway with TrustArc, the third-party privacy program recognized for online tax providers. The scope covers three phases, 16 standards, and 55 controls.
Third-party services
The outside services that support the systems and data described here.
- Hosting and database
- Hosts our web application, application services, and database.
- Edge and abuse protection
- Processes network requests and helps protect against automated abuse.
- AI and vision services
- Help read your documents and suggest values for your review.
- Document storage
- Stores uploaded documents in encrypted cloud storage.
- Certificate authority
- Verifies organization identity and issues security certificates.
- Independent security scanning
- Scans public systems for vulnerabilities.
Read FileFree’s privacy policy for details about data handling.
What the privacy certification covers
TRUSTe certification assesses an operating privacy and data governance program. TrustArc assesses the program across three phases, build, implement, and demonstrate, against 16 standards covering 55 controls:
- Integrated Governance
- Risk Assessment
- Resource Allocation
- Policies and Standards
- Processes
- Awareness and Training
- Data Necessity
- Use, Retention, and Disposal
- Disclosure to Third Parties and Onward Transfer
- Choice and Consent
- Access and Individual Rights
- Data Integrity and Quality
- Security
- Transparency
- Monitoring and Assurance
- Reporting and Certification
Certification is in progress.
Compliance registers last reviewed: August 23, 2026.