Data & security
What happens to your information.
Stated literally, and only what's true today. Where something isn't built yet, this page says so. OpenYear is operated by RegAtlas, LLC.
Right now
The OpenYear app is in internal testing and isn't open to customers yet. This website collects app access requests, optional free email signups and links to Stripe for the separate Planning Letter membership. It does not collect tax documents. Everything below describes the app's current data handling and the protections that will apply when customer access begins.
Your books
OpenYear reads your books and never changes them. When you connect VisiBooks, the connection itself only allows reading. QuickBooks doesn't offer a read-only permission, so its screen will ask you for full access — but OpenYear's software only ever reads. You can disconnect either one at any time.
Your documents
The file you upload is kept exactly as you uploaded it, including every identification number in it. It's stored in private storage with Backblaze, encrypted at rest.
To read it, OpenYear sends the whole file to Anthropic, through Anthropic's commercial API. Anthropic doesn't use API data to train its models, and deletes it within 30 days — unless its safety systems flag it, in which case it can be kept for up to two years. (Training,retention.)
What OpenYear keeps from reading it — the facts it found, the quoted words behind each one, and a summary — has Social Security, taxpayer and employer identification numbers belonging to anyone other than your business masked to their last four digits. That masking happens after Anthropic has read the file, and it applies to what OpenYear extracts, not to the original.
Nothing read from a document reaches your business's profile until you confirm it.
What's encrypted in the database
- Your business's employer identification number
- The facts read from your documents, and the quoted evidence behind them
- Document summaries and notes
- The credentials for your connected books
- Authenticator-app secrets
Each is encrypted field by field, with keys held apart from the database, so a copy of the database alone doesn't reveal them. Other data — business and owner names, return lines and figures from your books — is protected by access controls, not by field encryption.
Passwords aren't encrypted at all: they're stored only as one-way bcrypt hashes, which can't be turned back into the password.
The database is backed up every night. Each backup is encrypted before it leaves the server, with a key the server doesn't hold, and kept in separate storage for 35 days, where the same server can write backups but can't read or delete them.
Not yet done: the database's own disk on OpenYear's server isn't encrypted, so the fields listed above are the encrypted part of it. That's being fixed, and this page will say so when it is.
Signing in
A password and a code from an authenticator app. Sessions end after seven days without use, and after thirty days regardless.
A forgotten password is reset from a link emailed to you, which works once, for 15 minutes. Setting a new password signs out every device and emails you that it changed. The link replaces only the password: signing in still takes the code from your authenticator app, so someone with access to your email alone can't get in.
Retention and deletion
Documents, and everything read from them, are kept until you delete them.
An account nobody signs in to for two years is deleted, with every business only it can see. We write to you when the two years pass, again a week before, and once afterwards. Signing in at any point stops it — that's all it takes.
You can delete these yourself, in the app, and they're gone when the page says so:
- A document — the file is removed from storage, every stored copy of it included, along with the facts, quoted evidence and summary read from it. Facts you already confirmed onto your business stay on its profile.
- A business — everything held for it: its documents and files, facts, ownership, returns and strategy results, for everyone who can see it.
- Your account — your sign-in, and every business only you can see. A business someone else also has access to stays for them.
Deleting something from OpenYear doesn't reach copies Anthropic may still hold under its own retention, described above. For anything else, write to RegAtlas, LLC at hello@openyear.tax.
Applications are kept until OpenYear opens to you or you ask to be removed.
This website
The site counts its own visits so it can tell whether it's working: which page was loaded, the site or campaign tag that sent the visit, the country Cloudflare reports, when someone starts the application form, and when someone applies. It also counts demo and offer interactions. Pageview events record no IP address, browser details or visitor identifier. The origin of your visit is held in your browser's session storage until you close the tab. Separately, signup records save available campaign attribution with your email; a 90-day first-party cookie set after signup helps connect a later checkout. Stripe receives an opaque checkout reference, and reports can also match an earlier signup by checkout email. See the website privacy policy for retention and choices.
There are no third-party analytics or advertising scripts on the site or in the app.
Who processes it
The website and app run on Cloudflare. The application and its database run on OpenYear's own server, which accepts traffic only through Cloudflare's network with a service credential — it isn't reachable directly from the internet. Documents are stored with Backblaze. Anthropic reads uploaded documents. Email — password resets and account notices — is sent through Amazon Simple Email Service, which receives your email address and the message.
OpenYear doesn't sell your information, share it for advertising, or use it for anything but your planning.