Trust

Security

Last updated: July 14, 2026

Plain-language overview. Security also depends on the production host, database, email provider, and the way deployment secrets and backups are managed.

Quarterlease handles taxpayer financial data, so protection is built into the application instead of left to user habit. This page describes safeguards enforced by the software and calls out controls that remain deployment-specific.

Encryption

Production requires HTTPS. Client records and firm settings are also encrypted before they are written to the database using AES-256-GCM authenticated encryption. Each record is bound to its firm and record identifier, which prevents encrypted records from being copied into a different account context. Database connections verify TLS certificates by default when the database is remote.

Access control

  • Each firm's data is separated by account, so one firm cannot see another's data.
  • Within a firm, administrators can grant each preparer access only to assigned clients.
  • User deactivation, role changes, password resets, and account freezes invalidate access immediately.
  • The platform operations dashboard uses firm metadata and counts. It does not return taxpayer records.

Authentication

New passwords must be at least 15 characters and are stored with a salted, memory-hard scrypt hash. Sessions use HTTPS-only, HTTP-only cookies, expire after inactivity, and have an absolute lifetime. Password-reset and email-verification tokens are stored as one-way digests. Multi-factor authentication is not currently available.

Infrastructure

The application refuses to start in production when its session secret, data-encryption key, HTTPS application URL, or Stripe webhook verification is unsafe. Hosting, database backup frequency, key custody, access logging, and disaster recovery remain deployment controls and should be documented by the operator before real client data is loaded.

Payments

Card payments are processed by Stripe Checkout and the Stripe customer portal. Quarterlease does not receive or store full card numbers. Billing status changes are accepted only from Stripe webhooks with a valid signing secret.

Data retention and deletion

Administrators can delete a client or the entire account. Account deletion removes live client records, users, access assignments, pending imports, and account metadata. Completed import payloads are cleared immediately. Daily maintenance schedules abandoned unpaid imports for deletion after 24 hours. Residual copies in infrastructure backups, when enabled, expire under the deployment provider's backup schedule. See the privacy policy for details.

Reporting a vulnerability

If you believe you have found a security issue, email security@quarterlease.com with details so we can investigate. Please do not publicly disclose an issue before we have had a chance to address it.

Contact

support@quarterlease.com, Quarterlease LLC.