How CryptoTax secures your data

Last updated: March 2026

You trust CryptoTax with your wallet addresses and exchange accounts. We take that seriously. On this page we explain in plain language what we do to protect your data - and just as importantly: what we do not do.

Read-only access: we cannot move or withdraw anything

CryptoTax works exclusively with read-only permissions. Depending on how you connect your data, that means:

• Wallet import (Ethereum, Base, Arbitrum): you only provide a public wallet address. CryptoTax queries the blockchain to retrieve your transaction history - just as anyone can via a block explorer. We never store private keys and have no access whatsoever to your wallet itself.
• Exchange import (Kraken, Binance, Coinbase): you create an API key yourself in your exchange account with read-only permissions and no withdrawal permission. CryptoTax reads your trading history but cannot place trades, request funds or change settings.

In short: CryptoTax cannot touch your crypto - not now, not in the future.

How we encrypt your exchange credentials

API keys you share with us are stored encrypted using an envelope-encryption system:

1. On storage, a unique key (Data Encryption Key) is generated and used immediately to encrypt your credential with AES-256-GCM - the same standard banks and governments use.
2. That unique key is itself wrapped by a separate key (Key Encryption Key) managed in a shielded vault (HashiCorp Vault).
3. The original key exists only briefly in memory and is never stored as readable text.

The result: even in the event of a data breach, your API keys are unusable without access to our separate key vault - and that is strictly shielded.

Your data stays in the EU

All your data is hosted on servers in Germany (Hetzner Cloud, Nuremberg data center). The entire infrastructure - application, database and backups - runs within the European Union.

• Database: PostgreSQL in a Kubernetes cluster on Hetzner, physically in Germany.
• Backups: encrypted daily before they leave the cluster.
• Payments: handled via Stripe - your card details never reach us.

What we store - and what we do not

• We do store: transaction history, calculated taxable events, lot data for FIFO calculations, and your account settings.
• Encrypted: exchange API keys (see above).
• Never: private keys, exchange passwords, or credit card details.

Who has access to your data?

Only you have access to your own data. CryptoTax uses a secure login system (OAuth2/OIDC) with separated user roles.

• You as the user: full access to your wallets, events and reports.
• Your accountant: only if you explicitly send an invitation and the accountant accepts. You can revoke access at any time.
• Audit trail: whenever an accountant views your data, downloads a report or makes an adjustment, it is logged.

Read more about the terms for accountants on the accountant terms page.

Deleting data

You can delete your account at any time. This is what happens then:

• API keys: the encrypted key is permanently destroyed - decryption is impossible afterwards.
• Transaction data: all wallets, events and calculations are fully removed.
• Contact messages: anonymized.
• Analytics data: disconnected from your identity.

This is in line with your GDPR right to erasure. The only exception is that we are legally required to retain tax-related data for 7 years in accordance with Belgian tax law (Art. 315 WIB 92) - but that data is also encrypted and shielded.

Third parties

CryptoTax does not share your data with third parties for marketing or commercial use. We only work with service providers required to run the platform:

• Blockchain data: Alchemy and Etherscan (retrieving public transaction data - your wallet address is already public).
• Payments: Stripe (we do not see your card details).
• Authentication: Okta (secure login).
• Email: Mailgun via EU processing.

Questions or concerns?

Do you have questions about how we handle your data? Feel free to get in touch. You can also read our full privacy policy.

Ready to calculate your crypto taxes securely? Try CryptoTax for free.