Tax pros handle SSNs, EINs, addresses, and dollar figures that map to people. We treat that data the way the IRS expects: with isolation, encryption and audit trails.
Authentication runs on Clerk. Passwords never touch our servers. Every protected route checks your Clerk session, or your API key for the API, before it reads any data.
Each user gets an isolated workspace keyed off their Clerk user ID. No shared accounts, no collaborator-creep on multi-client data.
Submissions, records, and amounts live in Neon Postgres. The database is never reachable from the browser. Every query runs server-side, and the data layer scopes each one to your org before it executes.
Original uploads from the background queue and generated files are stored in Cloudflare R2. Both stores encrypt data at rest (AES-256) at the platform layer.
Every request between your browser, our app, Clerk, Neon, Cloudflare R2, Stripe, and the IRS A2A API is TLS-encrypted. The marketing site, the app, and the API all enforce HTTPS; HSTS is on at the platform layer.
No customer 1099 data ever flows over an unencrypted channel, including during conversion, submission, and ack-polling.
Files over 2 MB, files sent through the API, files with more than 10 payers, and files that need column mapping go to a background queue. We store the original file with the submission, so the queue can process it and you can remap it. A small file that converts at once isn’t stored in its original form.
Parsed records and generated files (IRIS XML, Portal CSV, recipient copies, state files) stay with the submission until you delete it, so you can re-download, audit, or file a correction. A file that waits for column mapping more than 30 days is deleted. After the IRS gives a submission a receipt, you can’t delete it, because it’s the record of what we transmitted.
PIXELCOVE, LLC is the IRS transmitter. Your clients do not need their own Transmitter Control Codes. IRISfile files returns with the IRS through the IRIS A2A system on your behalf. Each transmission is tied to your org in our records, with its IRS receipt ID and acknowledgement.
Before we send a transmission, we check that its XML matches the exact file we generated (by SHA-256 hash). IRISfile also produces IRIS XML, IRIS Portal CSV files and recipient copies that you can download.
Our privacy notice lists every vendor that receives data.
If you spot a vulnerability or have questions about our handling of a specific data flow, write to security@irisfile.co. We acknowledge within one business day and triage from there.
Tabular numbers. Audit trails. No data we don't need.
Get notified