What makes Expatfile the most reliable tax filing app for US expats
A tax return is one of the most personal documents there is, and filing from abroad means trusting it to a company an ocean away. So "is Expatfile safe?" is exactly the right question. Here's what actually happens to your data, from the moment you type it in.
It leaves your device sealed
Before your data leaves your browser, it's encrypted with post-quantum key exchange on our public connections. Why does that matter? Some attackers record encrypted traffic today, betting that tomorrow's quantum computers will crack it open. We've already closed that door. And our Extended Validation certificate, issued to Expatfile.tax LLC, means your browser verifies it's really us before a single byte is exchanged.
It lands in a vault with many rooms
Our platform isn't one big system with one big key. It's dozens of small, isolated services, each with its own identity, its own credentials, and access to only its own database. None of them are directly exposed to the internet, and everything at rest is encrypted with AES-256. Security experts call this the principle of least privilege, and we hold our people to the same standard: team members get only the access their work requires, and every administrative action on your data is recorded in an audit log. A key to one room doesn't open any other, for software and humans alike.
The password you'll never create
Stolen passwords are how most accounts fall. Ours can't be stolen, because there are none. You sign in with a secure email link, a passkey, or your Google or Apple account. Sessions quietly expire when you step away, and we watch every session for signs of hijacking: if yours suddenly appears from a different browser or country, we end it on the spot.
The card number we never see
You pay on the secure checkout pages of our payment provider, a PCI DSS Level 1 certified processor, the highest level there is. Your card number never touches our servers, and we don't store it. Not even the last four digits. We can't lose what we never had.
We don't grade our own homework
Every single week, an independent security firm scans our platform for vulnerabilities in line with the PCI Data Security Standard, a bar we're held to as an IRS-authorized e-file provider. On top of that, we commission independent penetration tests: real experts trying to break in, so we find the cracks before anyone else does.
The IRS and FinCEN know us by name
Expatfile is an IRS-authorized e-file provider, and we transmit FBARs directly to FinCEN through the official BSA E-Filing system. Federal agencies don't hand out those authorizations lightly, and your return goes straight to them with no middlemen.
Your data, your rights
At Expatfile, we believe in your right to control your personal information. If you wish to have your data deleted, a simple email to our support team is all it takes. This policy is part of our ongoing commitment to not just meet, but exceed, our users' expectations for privacy and control.
Yours to keep and yours to delete
Your data belongs to you. If you ever want it gone, one email to our support team and we'll delete your personal data from our systems. No hoops, no talking you out of it.
Still have questions about how we protect your data? Ask us. We'd rather explain our security than have you wonder about it.