Connecting an exchange or uploading a CSV gives Coinfig access to your financial history. Here is how we protect that information, where we store it, and what you can control.
Connecting exchanges and wallets
For an exchange connection, create an API key in your exchange account and give it read-only permissions. Coinfig needs access to your transaction history. Trading and withdrawal permissions should be disabled.
You can also import CSV statements from supported sources if you prefer not to connect an exchange by API.
Wallet connections are watch-only. You add a public address or an extended public key, such as an xpub. Coinfig rejects private keys and seed phrases. If you accidentally enter one, treat it as compromised and move the funds to a new wallet.
How we protect your credentials
Coinfig encrypts stored exchange API keys, secrets, passphrases, and accounting-integration tokens, such as Xero tokens, using AES-256-GCM. The encryption also detects changes to stored credentials.
Coinfig keeps the encryption key on the server. Its sync services decrypt credentials when connecting to your exchange to retrieve your history.
Your connection to Coinfig uses HTTPS. Connections between the application and its production database use TLS encryption in transit.
This additional encryption of stored credentials does not extend to every database field. We store transaction history, reports, and profile information in our hosted database in South Africa.
Clerk handles sign-in, so Coinfig does not store your password. PayFast and Stripe process payments, and we do not store full card numbers.
No system is 100% secure. Section 8 of our Privacy Notice describes our security measures.
Where your data is stored
Coinfig runs on Amazon Web Services in the Africa (Cape Town) region. Our application, database, storage, and services that import transactions and pricing data are hosted there.
Cloudflare helps deliver and protect the website. It handles traffic through its global network, while our application and stored records remain hosted on AWS.
Some supporting providers process limited information outside South Africa. These include Clerk for authentication, Cloudflare for website delivery, payment processors, and PostHog in the European Union for product analytics when you accept optional cookies. Section 7 of the Privacy Notice explains these arrangements.
We do not sell your personal information. See section 6 of our Privacy Notice for how we may share personal information.
Deleting a source or your account
You can delete an individual source without deleting your account. We delete that source's imported transaction data and keep records from your other sources. We delete its stored API credential once no other source uses it. You should also revoke the API key in your exchange account when you stop using it.
To request account deletion or a data export, email help@coinfig.tax. Some records and backups may remain subject to the retention requirements and backup limits described in section 10 of the Privacy Notice.
ISO 27001 certification is in progress
ISO/IEC 27001 is an international standard for managing information security. It covers areas such as access controls, risk management, incident handling, and supplier review.
Our controls are aligned to ISO 27001:2022, and we are working towards certification with Scytale. Coinfig is not currently ISO 27001 certified. We will update this article and the Privacy Notice when a certificate is issued.
Protecting your account
Enable multi-factor authentication on Coinfig through Clerk, and on the email or SSO account you use to sign in. Keep exchange API keys read-only, and never enter a private key or seed phrase into a tax tool.
For questions about security or privacy, email help@coinfig.tax. Our Privacy Notice contains the full details of how we process personal information, including how to raise a complaint with the Information Regulator of South Africa.