№ 01 · TaxSQR-side
Platform Admin
Cross-firm: provision tenants, rotate keys, ship platform-wide announcements. One person at TaxSQR, not in your firm.
Feature · Roles
Seven roles. One ledger.
Every CPA firm is a small federation. The owner sees everything. The reviewer sees their assignments. The taxpayer sees only their own tax returns. TaxSQR ships seven roles on one database — and every action is org-scoped at the query level, not at the UI.
§ Section I · Roles
Seven roles. One ledger.
All ship in The Practice
№ 02 · Firm-wide
Owner
Sees the whole firm — pipeline, every taxpayer, every case, every audit-log entry. Can transfer ownership of any case.
№ 03 · Ops
Office Admin
Operational: bills, seats, integrations, branded portal settings. No tax-return write access.
№ 04 · Review
Reviewer
Sees cases assigned for review. Can sign off, request preparer revisions, or transfer. Audit-log entries always tagged.
№ 05 · Draft
Preparer
Drafts tax returns in the case workspace. Sees only the taxpayers and cases assigned to them.
№ 06 · Corp
Corp Client Owner
For corporate-client groups (e.g., assignees from one employer). Sees their book; cannot see other firm clients.
№ 07 · EN · ES · JA
Taxpayer
Sees only their own tax returns. The taxpayer portal speaks EN/ES/JA end-to-end.
§ Section II · Isolation
Other firms’ data simply does not exist for you.
Much multi-tenant software will admit a record exists, just not for you — telling an attacker who else uses the product. TaxSQR reveals nothing. An attacker cannot fingerprint who else uses TaxSQR, let alone enumerate cases.
№ 01
Cross-tenant isolation
A reviewer in firm A who guesses an URL for a case in firm B finds nothing there. An attacker cannot fingerprint your client list.
Enforced
№ 02
Org-scoped queries
Every DB query filters by org_id at the ORM layer. There is no “super-admin” UI that escapes scoping.
ORM-level
№ 03
Per-role test coverage
CI runs an integration test suite per role on every commit. A new endpoint without a role-test fails the build.
Tested
№ 04
Same audit log everywhere
Every role’s actions write to the same append-only ledger. A taxpayer can request a CSV of every action against their record.
Transparent
Most multi-tenant systems are one tenant pretending to be many. We are many tenants on one well-designed database.
— TaxSQR Security Note