How We Protect Your Data

All tax documents and extracted financial data are stored exclusively on Swiss infrastructure (hosted by Infomaniak in Switzerland), and the core AI processing of your documents now also runs in Switzerland (Infomaniak AI). One processing step remains outside Switzerland, disclosed as an exception: payments are handled by Stripe, which may process data in the EU and the United States under appropriate safeguards (see our Privacy Policy, Section 8, for details).

TaxWize is operated by Szakács Solutions, a sole proprietorship (Einzelunternehmen, Swiss UID: CHE-289.567.114) in Eggenwil, Canton Aargau. Swiss data protection law (DSG/FADP) applies.

All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Documents you upload are stored in encrypted storage with access controls.

Access to production systems is restricted to authorised personnel.

We collect only what is needed to prepare your tax filing: your documents, the data extracted from them, and your answers to tax-related questions.

We do not sell your data. We do not use it for advertising. We do not share it with third parties except the subprocessors listed below.

You can delete your account and all associated data at any time from your settings page or by contacting privacy@taxwize.ch. Account deletion initiates permanent removal of your data from production systems within 30 days. Backup purging follows within an additional 30 days.

You can download your tax report before deleting your account. After deletion, we retain no personal data.

TaxWize uses AI to extract data from your uploaded documents and to generate tax insights. AI output can be incomplete or imperfect, so extracted values and insights are presented for your review and should be verified before you rely on them.

The AI that reads your document content and generates tax insights runs in Switzerland: Infomaniak AI, using an open-weight language model that Infomaniak hosts on Swiss infrastructure and does not use to train AI models. Text recognition (OCR), which converts document images into text, runs self-hosted on the same Swiss infrastructure, so no third party reads your documents.

Extracted data is stored in our Swiss-hosted database. Original documents are stored in Swiss-hosted encrypted storage.

We use a limited set of trusted subprocessors, each under a signed Data Processing Agreement:

We use Plausible Analytics, which is fully GDPR and DSG compliant. It does not use cookies, does not track individuals, and does not collect personal data. No cookie banner is needed.

Row-level security (RLS) ensures users can only access their own data. All API endpoints verify authentication and ownership before returning data.

We maintain a security.txt file for responsible disclosure. If you find a vulnerability, please report it to security@taxwize.ch.