Compliance and Security Overview
This Trust Center provides transparent visibility into Wylo Tax LLC's security, compliance, governance, and trust documentation, giving your procurement and security teams everything they need in one place.
SOC 2 Type 2
Third parties that process data on our behalf under strict contractual safeguards.
Amazon
Amazon Web Services. OBJECT STORAGE ONLY - a private S3 bucket (us-east-1) stores client tax and identity documents, keyed per tenant, with all public access blocked. AWS does NOT host the application or the database; that is DigitalOcean. Controls relied upon: physical and environmental security, storage durability, encryption at rest.
Cloudflare
Authoritative DNS, TLS termination, web application firewall and DDoS mitigation for wylo.tax, app.wylo.tax and api.wylo.tax. Because TLS terminates at the edge, customer data transits Cloudflare in plaintext in flight.
Comp AI
Compliance management platform holding the SOC 2 programme - policies, controls, tasks and evidence - plus the endpoint device agent reporting laptop compliance posture. Receives company compliance evidence and device telemetry. No customer or taxpayer data.
DigitalOcean
PRIMARY HOSTING PROVIDER and the single most critical vendor. One droplet in NYC3 runs the Laravel API, the React application, the marketing site, the queue workers and the Redis cache; DigitalOcean Managed MySQL (db-payroll-live, NYC3, private VPC) is the primary database holding all structured taxpayer records. Also provides the cloud firewall and the VPC. Backups are automatic daily with 7-day point-in-time recovery.
GitHub
Source control for all three repositories and the CI/CD deployment pipeline. Holds application source and deployment credentials as Actions secrets. No customer data - production data is never committed.