Security & Data Handling

How the conversion works

1. 1. Upload over HTTPS. Your file travels from your browser to our servers encrypted with TLS. The certificate is issued by Let's Encrypt and HTTP is redirected to HTTPS at the proxy.
2. 2. Server-side processing. A CSV is parsed entirely on our server — it never goes to any third-party AI. A 1099-DA PDF has its text extracted with the open-source pdf-reader library, and only that text is sent to Anthropic's Claude API for structured transaction extraction.
3. 3. The upload is deleted right away. Once the conversion finishes, the temporary file is removed from disk. Your original CSV or PDF does not persist beyond the processing window.
4. 4. The output is kept for 24 hours. The generated bundle (TXF, CSV, XLSX, wash sale report, import guide) is stored so you can download it, then automatically removed after 24 hours.
5. 5. Access is tied to your browser. There is no account. A private session cookie links the conversion to your browser. If you give us an email, we also send a private tokenized link to the same results so you can download from another device.

What we do not do

• We never ask for your exchange login. We only need the file you already exported. Your Coinbase, Kraken, or wallet credentials never leave your control.
• No account required. There's no sign-up, no password, and no profile. Email is optional and used only to send you the download link.
• No human review of your file. Processing is fully automated. No employee or contractor opens your CSV or PDF or reads your transactions.
• We do not train AI on your data. PDF text sent to Anthropic runs under their commercial API terms, which exclude that traffic from model training. CSVs never touch an AI service at all.
• We do not sell, share, or rent your data. Your transactions are visible only to you and to anyone you forward the download to.

Third parties involved

• Anthropic (Claude API) — extracts transactions from 1099-DA PDFs only. The PDF text is transmitted to Anthropic for processing and is excluded from model training under their commercial terms. Anthropic commercial terms.
• Stripe — payment processing for the one-time download. Card details go directly to Stripe and never touch our servers. Stripe privacy policy.
• Resend — delivers the optional "your download is ready" email. It processes the recipient address and message content; your CSV, PDF, and transaction data are never attached.
• Google Analytics — anonymous usage and conversion measurement (page views, checkouts, purchases). It never sees your file content or transactions.
• Hetzner — server hosting in Hetzner's Ashburn, USA data center.

Encryption and infrastructure

• HTTPS everywhere. All traffic to cryptotaxconverter.com is HTTPS; plain HTTP is redirected at the proxy layer.
• Private database network. The application talks to its database over a private Docker network that is not exposed to the public internet.
• Server-side only. Parsing and extraction happen in a Linux container on our server. No browser-side JavaScript ever reads your raw file; the upload goes straight to the backend.

What's stored, and for how long

• Original CSV / PDF: deleted immediately after the conversion completes. Not retained.
• Extracted transactions and the output bundle: stored for 24 hours so you can download them, then removed automatically.
• Email address (optional): stored only if you provide one, used to send your download link. Not sold or shared.
• IP address and user agent: stored for rate-limiting and abuse detection, not for marketing or profiling.
• Stripe payment metadata: we store the Stripe payment ID for paid conversions to verify your download entitlement. Card data lives on Stripe, not on our servers.

What Crypto Tax Converter is not

We're a conversion tool, not a tax advisor. A few honest distinctions:

• We convert what's in your file. When cost basis is missing (common on a 1099-DA for pre-2025 or transferred-in lots), we reconcile it against a history CSV you provide — we don't invent numbers.
• We do not file your return. The output is a TXF, CSV, or XLSX you import into TurboTax, TaxAct, or H&R Block, or hand to your accountant.
• We do not decide tax treatment. The IRS has not formally extended the wash sale rule to digital assets; we honor whatever your source reports. Complex scenarios are your decision or your preparer's.

Reporting a security issue

If you discover a vulnerability, please email support@cryptotaxconverter.com with details. We respond to security reports within 48 hours and prioritize fixes ahead of feature work.