Security
The parts that are hard to undo.
A compliance product asks for a list of the people you pay. That is a sensitive list even before anyone types a taxpayer number into it. Here is what WithholdWatch does about that, in specifics — and, at the bottom, what it has not done.
Taxpayer numbers
WithholdWatch never stores a full taxpayer number
Not encrypted, not masked on display, not held briefly. There is no field anywhere in the product that accepts one.
The form takes four digits
The W-9 screen has one taxpayer-number field and it is labelled “last four digits”. A value that is not exactly four digits is rejected with that reason, rather than trimmed to fit.
Imports reject a full number
A CSV row containing what looks like a complete taxpayer number is refused at the validation preview, before anything is written. It is not truncated and stored — the row is skipped and you are told which one and why.
No client role can read the ciphertext
The database has a column reserved for a future encrypted value. Nothing in the application writes it, and the signed-in database role is not granted the ability to read it, so it cannot be reached through the API even by a member of your own workspace.
The consequence, stated plainly: WithholdWatch cannot file a return for you, because filing needs the number it refuses to hold. It tells you who you need one from. That is a deliberate trade and it is the reason this list is short.
Workspace isolation
One workspace cannot see another
Isolation is enforced by the database, not by the application
Every table carrying your data has a team column and row-level security switched on. The rule is applied by Postgres to every query, including one made by a piece of application code that forgot to filter. A missing WHERE clause returns nothing rather than everything.
Every policy names the role it applies to
A policy written without an explicit role is granted to PUBLIC, which quietly includes the anonymous role. No policy in this database is in that state. The two reference tables — published thresholds and rates — are the only ones an anonymous visitor can read, deliberately, so the public calculator runs against real figures.
Read, create, update and delete are separate rules
They are four policies, not one. A single rule covering all four verbs would let any member of a workspace delete any row in it, which is not what anyone means by “member”.
Every view runs as the caller
A database view normally runs with its creator’s privileges, which silently bypasses row-level security for anyone who reads through it — and an isolation test still passes. Every view in this product is marked to run as the caller instead, and none of them is a materialized view, which cannot carry that marking at all.
Third parties
Sign-in and payment
Authentication
Sign-in is handled by the platform’s authentication service. WithholdWatch does not store passwords, and the session is a signed token checked on every request before any page code runs.
Payment
Subscriptions are handled by Stripe’s hosted checkout. Card details are entered on Stripe’s page and are never posted to WithholdWatch, so there is no card data in this product to protect.
Stated, not implied
What WithholdWatch has not done
Everything above is a property of how the product is built and can be checked. The following are things this page is not going to imply by leaving them out.
No third-party audit
There is no SOC 2 report, no ISO certificate and no penetration test. There is no badge on this page because there is nothing to put on it.
W-9 status is self-reported
Any member of your workspace can mark a contractor as having a valid form. WithholdWatch does not verify one against the IRS, and the count on your dashboard is labelled “Self-reported” for that reason.
WithholdWatch cannot see what you have not entered
Every figure is a floor computed from the payments you have recorded or imported. Partial data understates, always in that direction.
Federal only
WithholdWatch tracks federal information-return thresholds. It does not track state filing requirements, and states do not all follow the federal figures.