Security summary

The working notes for staff live in SECURITY.md at the root of this project. They map what this build already does to IRS Publication 4557 and the FTC Safeguards Rule, and they list what a real office still has to put in place. They are not a completed Written Information Security Plan.

In the product today: field-level encryption for SSN, ITIN, and bank numbers; hashed session tokens; shorter idle timeouts for preparers; an audit log; role checks on the preparer desk; and redaction before anything is written to the log or handed to the assistant.

Not done, and required before live taxpayer data: a named security officer, background checks, a penetration test, a real incident contact, encryption of the database at rest by the host, a content security policy, HSTS, and turning off the local MFA bypass.