Taxpayer data
The calculation engine is a pure function: inputs in, results out, nothing retained between requests. There is no per-taxpayer record to breach, export, subpoena or lose, because none is created.
Work in progress is held in the browser's own local storage on the machine being used. It never leaves that computer, and clearing it removes it. If a member of staff closes the tab without clearing, the entries remain on that workstation only — the same as an unsaved spreadsheet, and nowhere else.
Downloadable reports
A report is produced in memory and streamed straight to the browser. No copy is written on the server, and the response is marked not to be cached, so a shared counter workstation does not retain one either. The downloaded file exists only where the user saves it.
What Tabren deliberately does not do
No session recording or heat-mapping. Tools of that kind capture form field contents by default. They are excluded by policy, not merely unused.
- No analytics or third-party scripts on the calculator or the
administrative interface. Nothing is loaded from a content
delivery network, and there are no trackers or advertising tags on any
page where taxpayer information is entered or displayed.
The one exception is our public contact form at tabren.com/contact, which loads Google reCAPTCHA to stop automated submissions. That page is marketing only — no taxpayer data is entered there, it is never reached from inside the calculator, and reCAPTCHA is not present on the tool, on your own hostname, or in the administrative interface. - No logging of calculation inputs or results — not in application logs, not in web server access logs, and not in database query logs. Slow-query logging is disabled specifically because it would otherwise record the values submitted with a query.
- No error reports containing request data. Application errors do not serialize submitted values. Stack traces are configured to omit function arguments, which is the usual route by which a figure from a form ends up in a log.
- No process crash dumps, which would otherwise contain whatever was in memory at the time.
Authentication
Each office chooses one of the following. Both can be combined with network restriction.
| Option | How it works |
|---|---|
| Microsoft Entra ID |
Staff sign in with the Microsoft 365 accounts they already have, subject to your own MFA and conditional access policies. Sign-in is pinned to your directory: an account from any other Microsoft tenant is refused even though it is a valid Microsoft account. |
| Shared office license | A fixed number of simultaneous users. A seat is released when a user closes the tab, and automatically after a short idle period. |
What the Microsoft integration can access
Sign-in only: a name and an email address. The permissions requested are
openid, profile and email. There are no
application-level permissions, so Tabren cannot read mail, files, Teams,
calendars or your directory, cannot enumerate users, and cannot change
anything in your tenant. It can do nothing at all unless one of your staff is
actively signing in.
Setup is a single link sent to your IT department. There is no application to register and no client secret for you to hold or rotate. Consent can be withdrawn from your side at any time, which immediately ends access.
Network restriction
An office can be limited to its own address ranges, given as CIDR blocks. The check runs on every request — opening the tool, each individual calculation, and each report — not only at sign-in. A saved copy of the page computes nothing from outside the permitted range.
This is an independent control, not an alternative to authentication. An office can require single sign-on and restrict access to the building, and both are enforced.
Audit trail
What is recorded:
- Authentication events, including failures
- Source address and timestamp
- Which tool was opened, and for which tax year
- Session start and duration
- Administrative changes made by us to your account
What is not recorded: any value entered on a form, any computed result, and any taxpayer name or identifier. The fields permitted in an audit entry are defined by an explicit allow-list in the code, so a new field cannot begin appearing there by oversight.
License status and access
Access is checked against your license on every request. If a renewal is still moving through procurement, access continues through a grace period with a visible on-screen notice rather than stopping abruptly. Tax years you have already paid for stay available afterwards, so an amended return can still be worked.
Infrastructure
- All traffic is served over HTTPS. Plain HTTP is redirected, never served.
- Each office has its own hostname; a request for an unrecognized hostname is refused rather than served another customer's page.
- The database is not reachable from the network — only from the application itself.
- Uploaded files, such as your logo, are stored outside the web root and served through the application, so an uploaded file can never be executed.
- The application process cannot modify its own code.
Accessibility
Section 508 and WCAG 2.1 AA are procurement requirements for many Virginia localities. Accessibility is built into the interface rather than added afterwards: every field carries a real label naming its line number and description, line numbers act as row headers so context is announced, the form is fully keyboard operable, focus is always visible, and recalculated totals are announced to assistive technology.
We describe what is implemented rather than asserting a conformance level. If your procurement requires a formal VPAT or an independent audit report, contact us and we will tell you exactly where that stands.
Questions
If you have a security questionnaire, send it. We would rather answer it directly than have you infer answers from a page like this.