Building a Culture of Privacy in Tax AI
Updated: Aug 18
Privacy and Security
Privacy and security are central to everything we do at Instant.Tax.
From the outset, we've invested heavily in developing our platform with care, integrity, and a relentless focus on protecting customer information. Putting people at the heart of AI begins with respecting the privacy everyone deserves. That starts with data and extends to everything we touch.
In today’s digital world, privacy is more than a compliance obligation: it’s a core value and a mark of trust. As a domain-specific AI platform serving individuals, tax professionals, and global enterprises, we know that customer confidence depends on strong, transparent privacy practices.
Trust is a glass: fracture it once and it evaporates. It is the glue that bonds us together.
1. Embedding Privacy from the Top Down
At Instant.Tax, we treat privacy and security as core principles, not optional standards. This commitment starts at the top and shapes every decision we make. It ensures that privacy is embedded in all areas of the business, from engineering and product design to customer experience and operations.
We view trust as something that must be earned through consistent action. Our privacy and compliance teams work closely with every department to make sure the safeguards our customers rely on are reflected in daily practice.
Our teams operate under clear, non-negotiable principles: no training on customer data, zero data retention, and no human review of customer information. This alignment reflects a culture where privacy is built in from the start.
2. Making Clear and Transparent Commitments
Transparency is at the heart of any credible privacy program. Instant.Tax was among the early adopters of the Data Privacy Framework (DPF), committing to internationally recognised principles of fairness, accountability, and access.
Our Privacy Policy and Data Processing Agreement (DPA) outlines how we collect, process, and protect data. These commitments are backed by rigorous contractual obligations and independent oversight.
Every AI provider or subprocessor we work with must meet the same standards, including three key requirements:
No retention of customer data. All data is processed only for the duration of a request and securely deleted afterwards.
No human access to customer data. We follow an "eyes-off" policy that prevents human review.
No AI training on customer data. Customer data remains the sole property of the customer.
Our approach aligns with GDPR, ISO 27701, ISO 27001, and SOC 2 Type II standards, ensuring our privacy commitments are clear, auditable, and enforceable.
3. From Feedback to Action
Listening to our customers shapes the way we build. Instant.Tax gives customers direct control over their data. Users can set their own retention periods, as short as three hours, and delete their information at any time. We believe control and transparency are essential to trust.
Control, security and trust are critical foundations.
4. Applying Global Privacy and AI Regulations
With a global customer base, Instant.Tax actively monitors emerging laws and standards in privacy and AI governance.
Our program aligns with major frameworks, including the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), the UK Data Protection Act, the OECD AI Principles, the NIST AI Risk Management Framework (AI RMF), and the upcoming EU AI Act.
We follow developments in AI regulation closely, with a focus on transparency, accountability, fairness, and human oversight. Our compliance and legal teams collaborate with international experts to keep Instant.Tax ahead of global requirements and evolving best practices.
5. Privacy as a Living Value
Privacy at Instant.Tax continues to evolve. We conduct regular reviews, red-team assessments, and cross-functional audits to keep pace with new technologies and regulatory expectations.
Our security framework includes continuous vulnerability scanning, annual third-party penetration testing, and alignment with ISO 27001, SOC 2 Type II, and the NIST Cybersecurity Framework. These practices ensure that privacy and security remain measurable, consistent, and verifiable.
Privacy is more than a policy. Its a living value.
A Living Value
Privacy is a living value that defines how we design, build, and operate our technology.
By embedding privacy into our products, processes, and people, we aim to set a new standard for tax AI.
Peter Toumbourou
on behalf of Instant.Tax FAQ Questions we are asked most
Does Instant.Tax train AI models on customer data?
No. Customer data remains the property of the customer and is never used to train a model — not by us, and not by any AI provider or subprocessor we work with. The requirement is contractual, not a preference.
How long is customer data retained?
Data is processed for the duration of a request and securely deleted afterwards. Customers set their own retention period, as short as three hours, and can delete their information at any time.
Can anyone at Instant.Tax read customer data?
No. We operate an eyes-off policy: no human review of customer information. Every subprocessor is held to the same standard.
Which standards does Instant.Tax align with?
GDPR, the CCPA, the UK Data Protection Act, ISO 27001, ISO 27701 and SOC 2 Type II, alongside the OECD AI Principles, the NIST AI Risk Management Framework and the EU AI Act. We were an early adopter of the Data Privacy Framework.
