Where every number comes from
Payroll is unforgiving. Here is exactly how a rate gets from a government PDF to your API response, and what stops a wrong one getting through.
1. We read only official sources
Each tax program has a short allow-list of government URLs (irs.gov, ssa.gov, state revenue and labor agencies). The agent fetches them, stores a SHA-256 fingerprint of the exact bytes, and skips anything that hasn't changed since the last run.
2. An AI agent extracts the rules — twice
The model fills a strict schema: rates, wage bases, thresholds, brackets and the effective date. It runs two independent passes. For every value it must return the exact sentence from the document that supports it.
3. Deterministic checks, not vibes
Code — not the model — verifies that each quote appears word-for-word in the source, that the number appears in its quote, that brackets are contiguous, and that both passes agree. Any failure blocks the version.
4. A person approves it
Tax reviewers see a field-by-field diff against what is live today, with the quotes alongside. They approve or reject; the number of approvals required is configurable, and every decision is recorded.
5. Published as a new, immutable version
Approved versions are effective-dated and never edited. A correction is a new version that supersedes the old one, so you can always reproduce what the API said on any date.
Don't trust us. Check.
Each tax in a response includes its version number, when it was published, a content hash, and the source documents with their fingerprints. Your auditors can follow any figure back to the page it came from.
- Source URL and SHA-256 of the copy we read
- Version id, number and publish timestamp
- effective_from / effective_to for every rule
- as_of queries to replay any past answer (Growth and above)
How we handle your access
Keys are hashed
We store only a SHA-256 hash of your API key. It is shown once when created; if you lose it, revoke it and make a new one.
No payroll data needed
Requests carry a state and a date — never employee names, SSNs or wages. There is nothing personal for us to leak.
Tamper-evident audit log
Every approval, publish and key change is written to a hash-chained log that can be verified end to end.
The data is provided to help software apply published rules and is not legal or tax advice.