Storage and access

Where the files live and who can reach them

Stored in the United States

Hosted on DigitalOcean in its New York region.
Each firm's documents and workbooks sit in a separate store for that firm.
Every page and file request is checked against the signed-in firm. No firm can open another firm's engagement, even with a direct link.

Encrypted in transit and at rest

Client documents and workbooks sit on an encrypted storage volume, snapshotted nightly.
Every connection uses TLS. Plain-HTTP requests are redirected to HTTPS.
Browsers are told to use only HTTPS for this site (HSTS) and not to let other sites frame its pages.

Roles inside your firm

Admins manage firm settings, users and retention, and are the only ones who can delete clients or engagements (each delete needs a typed confirmation).
Members work clients and engagements.
Turning off a user signs them out everywhere at once.

Lunar Papers' own access

Production servers are reached only by Lunar Papers' operator, with key-based SSH. There are no shared passwords.
Keys and secrets live in the server's environment, never in the code.
Nobody at Lunar Papers opens a firm's files unless the firm asks for help with that engagement.

Sign-in

Accounts and sessions

Sign in your firm's way

Google or Microsoft sign-in. Your firm's own multi-factor and account policies then apply to Lunar Papers.
Emailed links work once and expire in 20 minutes.
Passwords need at least 10 characters. Each is stored only as a salted PBKDF2-SHA256 hash (200,000 rounds), never as the password itself.

Guessing is cut off

After 8 wrong passwords for one address, password sign-in for that address pauses for 15 minutes.
Heavy traffic from one network is paused the same way.
Requests for sign-in links are limited, so an inbox can't be flooded.

Sessions end on their own

The session cookie is HttpOnly, Secure and SameSite, so page scripts and other sites can't read or send it.
Sessions expire after 14 days, enforced on the server as well as in the browser.
Signing out ends the session on the server. Changing a password signs that person out on every other device.

Every action is on the record

The audit trail records sign-ins, wrong passwords, uploads, downloads, edits, client emails, retention deletions and deletes, each with who and when.
The audit trail stays for the life of the account.

Retention and minimization

Less kept, for less time

Deleted on your schedule

After delivery, everything carrying the client's information is deleted automatically on the retention window your firm sets: uploaded documents, organized copies, question screenshots, the engine's working files and its processing logs.
Engagements that didn't finish are cleaned up on the same window, counted from when they stopped.
The window is 30 days by default and can be set anywhere from 7 to 365.
The workbook, comparison reports and the audit trail stay so you can retrieve them. Files your firm puts in a client's permanent file stay until you remove them.
On request, the whole account and its data are deleted within 30 days.
Deleted data can linger for up to 7 more days in our encrypted backups and storage snapshots (kept only to recover from a failure), then it's overwritten.

Sensitive numbers masked

Workbooks show SSNs to the last four digits only.
Organized copies mask account numbers to the last four.
Client records in the app don't store SSNs or birthdates.
Originals stay exactly as uploaded until the retention window closes.

AI processing and §7216

How the engine handles tax return information

One AI provider, commercial terms

Workpapers are built with Anthropic's models through its commercial API. Under those terms, data sent through the API is not used to train models.
Every request is set to run inference only in the United States.
Only what the engagement needs is sent.
Your clients' information is never used to improve Lunar Papers, compile statistics, solicit anyone or train anything.

Treated as a §7216 preparer

Lunar Papers holds itself to §7216 as a tax return preparer. Your firm discloses documents for workpapers under Treas. Reg. §301.7216-2(d)(1).
Before you upload a prepared return for a Return Comparison, your firm gets the client's written consent; the app supplies the form and asks you to confirm it's on file.
Every provider and person with access has the written §301.7216-2(d)(2) notice and is bound to confidentiality (see our Privacy Policy, §4).

Service providers

Who else touches the data

Provider	What it does	What it receives
DigitalOcean, LLC	Hosting, United States (New York)	Everything stored by the service
Anthropic, PBC	AI processing through the commercial API	The engagement documents and instructions needed to build or compare that engagement (US-only inference)
Resend	Transactional email	Email addresses and the sign-in or notification message
Google LLC, Microsoft Corporation	Sign-in, only if your firm uses it	The sign-in request; we receive name, email and an account ID

No advertising or cross-site tracking cookies. Information is never sold.

Straight answers

What firms ask

Do you have a SOC 2 report?

Not yet. This page, our Terms and our Privacy Policy describe the controls in place today. Send your vendor security questionnaire to hello@lunarpapers.com and we'll complete it.

Is multi-factor authentication required?

Yes, for everyone. Password sign-ins need a 6-digit code emailed to the person's own address (a browser can be trusted for 30 days). Google and Microsoft sign-ins use your firm's own MFA policy. The ops console uses an authenticator app.

Do we need our clients' consent under §7216?

For workpapers, no: your firm discloses to Lunar Papers as another preparer assisting with the return, under §301.7216-2(d)(1). For a Return Comparison, yes: get the client's written consent first. The app supplies a consent form in the Rev. Proc. 2013-14 format, and you confirm it's on file before uploading the return. Many firms attach it to the engagement letter as a separate page.

What goes in our WISP?

List Lunar Papers as a service provider that handles taxpayer data, with its role and safeguards. Printing this page gives you that summary; the button is at the top.

What if something goes wrong?

Report anything suspicious to hello@lunarpapers.com. If we determine, or have reason to believe, that a firm's data was accessed without authorization, we notify that firm's admins as the law requires and in any event within 10 days after we determine it happened, as Florida law requires of a third-party agent (Fla. Stat. §501.171(6)). We give the firm what it needs to meet its own obligations to its clients.

How do we delete everything?

An admin can delete any client or engagement at any time; this removes the files and records. To close the account and delete all its data, email us and it's done within 30 days.

Your clients' returns, handled the way your engagement letter promises.