Your Data. Our Fortress.
Client-side encryption protects your sensitive W-9 data before it ever leaves your browser, with automatic deletion built in.
Built for Compliance. Designed for Peace of Mind.
Every layer of W9Vault is designed with security-first principles, ensuring your sensitive data is protected at every step.
Client-Side Encryption
Files are encrypted in your browser with TweetNaCl before upload; all transmission is protected with TLS.
30-Day Auto-Deletion
Documents are automatically deleted after 30 days for complete data privacy.
Encrypted Before Upload
Files are encrypted in your browser before upload, so plaintext file contents never reach our servers.
MAC Verification
File integrity verification ensures documents haven't been tampered with.
Technical Security Specifications
The specific practices behind our infrastructure security.
Infrastructure Security
TLS Encryption
All data transmission protected with industry-standard TLS encryption
Rate Limiting
Protection against brute force attacks and abuse
Input Sanitization
All user inputs validated and sanitized for security
Content Security Policy
Browser-level protection against XSS and injection attacks
Data Protection
Key Wrapping at Rest
Each file's encryption key is further protected at rest with AES-256-GCM, using a server-held master key
Client-Side Encryption
Files encrypted in your browser using TweetNaCl library
30-Day Auto-Deletion
All documents automatically deleted after 30 days for privacy
Encrypted Before Upload
Files are encrypted in your browser before upload, so plaintext file contents never reach our servers
Built-In Security Features
Every layer designed with security-first principles.
Authentication Checks
Secure user authentication with session validation and automatic timeout protection.
Audit Logging
Comprehensive activity logging for compliance and security monitoring without exposing sensitive data.
File Integrity
MAC verification ensures uploaded documents haven't been tampered with or corrupted.
Security FAQ
Common questions about W9Vault's security practices.
How secure is my data on W9Vault?
Your files are encrypted in your browser using TweetNaCl (XSalsa20-Poly1305) before they're ever uploaded, and each file's encryption key is further protected at rest with AES-256-GCM. All data in transit is protected with TLS.
What happens to my data after 30 days?
All W-9 documents and associated data are automatically and permanently deleted after 30 days. This automatic deletion is cryptographically verified and cannot be recovered, ensuring complete data privacy and compliance with data retention policies.
What security standards does W9Vault follow?
W9Vault follows industry-standard security practices including client-side TweetNaCl encryption, AES-256-GCM key wrapping at rest, TLS data transmission, input sanitization, rate limiting, and comprehensive audit logging, plus automatic 30-day data deletion.
Who has access to my data?
Only you and the vendors you send requests to are meant to access the data in the normal course of using W9Vault. Files are encrypted in your browser before upload, so plaintext file contents never reach our servers during that process.
How do you protect against data breaches?
We use multiple security layers including client-side encryption with TweetNaCl, TLS data transmission, rate limiting, input sanitization, and Content Security Policy. If our file storage were compromised on its own, file contents would remain encrypted — decrypting them also requires a separate, server-held key that isn't stored alongside the files.
Have Security Questions?
Have questions about our security practices, encryption implementation, or need technical details for your security review?