Trust & Security

Security built for the client data you’re trusted with.

Marble is SOC 2 Type II audited every year, encrypts your data in transit and at rest, and never uses it to train AI models. Our controls, subprocessors, and SOC 2 report are all in our trust center.

Request the SOC 2 reportBook a demo

What we commit to with your data

The data you handle is sensitive, your own and your clients’. Protecting it is our top priority.

  • Your data is yours.

    We never sell it or rent it, and we share it only as needed to provide our services.

  • No training on your data.

    Marble does not use your data to train AI models, and does not allow any third party to either. What you entrust to us stays private.

  • Zero data retention for LLMs.

    Marble uses zero data retention with its LLM providers, so what we send them to generate a response is not stored afterward.

  • Encrypted in transit and at rest.

    Data is encrypted in transit, and your documents are encrypted at rest in secure cloud storage.

  • Access limited to those who need it.

    Internal data access controls limit who at Marble can reach your data to authorized employees, with unique credentials for every account and multi-factor authentication for remote access.

  • Hosted in the US.

    Your data is stored on US-based infrastructure from Amazon Web Services.

SOC2 Logo

SOC 2 Type II

Audited every year by an independent auditor. Request the full report from our trust center.

Policies and documents

Trust centerSubprocessorsPrivacy PolicyTerms of Service

Controls

How we protect it.

Each of these controls is listed, with its current status, in our trust center.

  • Restricted access

    Access to the systems that hold your data is limited to authorized employees, with unique credentials for every account. It is based on job role or a documented request with manager approval.

  • Multi-factor authentication

    Marble supports multi-factor authentication to secure user accounts. Employees can reach production systems remotely only with multi-factor authentication over an approved encrypted connection.

  • Encrypted at rest

    The datastores and secure file storage that hold your documents and data are encrypted at rest, and access to encryption keys is limited to people with a business need.

  • A segmented, monitored network

    Our network is segmented and firewalled to keep customer data away from unauthorized access, and an intrusion detection system monitors it continuously.

  • Vetted people and devices

    New employees go through background checks, mobile devices are centrally managed, anti-malware is deployed on relevant systems, and a password policy is enforced.

  • Assessed every year

    On top of our annual SOC 2 audit, we run control self-assessments at least annually, follow formal vulnerability management and system monitoring policies, and take corrective action on findings.

Reviewable AI

AI your team can check.

Security also means being able to trust the output, so Marble shows its work.

  • Every claim is cited

    Click any citation to read the full statute, regulation, or ruling in context before an answer goes into a client file.

  • Primary sources, not the open web

    Answers are generated from and checked against the Internal Revenue Code, IRS guidance, and each state’s tax code and guidance.

  • Your judgment stays in charge

    Marble automates more of the work while keeping its reasoning visible, so you can review it and apply your professional judgment.

Security and compliance FAQ

Short answers to the questions IT teams and firm partners ask most.

Visit the trust center

Questions from your IT team?

Start in our trust center, email support@marble.ai, or book a demo and bring your questions to our team.

Visit the trust centerBook a demo