What this architecture means
No application case database does not mean no information is processed.
Case-entry fields remain in the browser session, but account providers and hosting infrastructure still process the ordinary information needed to authenticate users, deliver pages, prevent misuse, diagnose failures, and operate the service. A user-created PDF also persists wherever the user saves or sends it.
Current design controls
Browser-session case processing
Manual case inputs and calculated results are held in session storage for the signed-in browser session. The application does not intentionally send those case-entry fields to an application case database.
Authenticated workspace
The case-entry and report workspace is restricted to authenticated advisor accounts. Account identity, login, password-reset, session, and security functions are provided by Clerk.
Data minimization
The interface instructs users not to enter Social Security numbers, full account numbers, passwords, login credentials, or other unnecessary sensitive identifiers.
User-controlled clearing
Users can clear the active case. Signing out or changing users also removes the case session from the browser. Clearing the case does not delete a PDF already printed, downloaded, emailed, or stored elsewhere.
Provider separation
Authentication and hosting providers may process account, device, network, request, and security information. Those records are separate from the case-entry fields held in browser session storage.
No hidden compliance archive
The service is not a books-and-records repository. Firms remain responsible for placing any required report or communication in an approved recordkeeping system.
Shared responsibility
Security also depends on the advisor and firm.
Use the individual named-advisor account assigned to you, and protect its credentials and recovery methods.
Do not share account access; each additional advisor requires a separate subscription.
Use preferred names or initials and avoid unnecessary identifying information.
Keep browsers, operating systems, endpoint protection, and devices current.
Do not use public or untrusted devices for client-related work.
Clear the active case when work is complete and securely handle exported PDFs.
Follow the firm's vendor, privacy, incident-response, supervision, and recordkeeping procedures.
Security and availability limitations
No internet service or device is completely secure or continuously available. RetireTax Scan Pro does not currently claim an independent SOC 2, ISO, penetration-test, uptime, disaster-recovery, or regulatory certification. Provider certifications apply to those providers, not automatically to this product. Internet and authentication access are required to use the hosted service.
Review the current providers and their official resources on the service providers page.