With DAC8 and CARF, crypto platforms collect your transactions and report them to the tax authorities. Using a tax assistant is therefore becoming almost essential. But entrusting it with your entire history also exposes your data: in the event of a leak, it could reveal the extent of your wealth. Here are the security criteria to check, using CoinTracking as an example.
Why the security of your crypto tax data matters
To calculate your capital gains, a tax assistant needs to know your platforms, wallets, purchases, sales, and portfolio value. This centralization makes filing your tax return much easier, but provides an almost complete map of your crypto holdings. Linked to your identity, this information is clearly valuable to malicious actors.
The risk of a data leak is also very real in the sector. Several players in the ecosystem have already suffered customer data leaks, with two main consequences for the people affected:
- Targeted phishing: an attacker who knows which crypto platforms you use and what you hold can convincingly impersonate an exchange, a customer service representative, or the tool itself;
- Physical attacks: kidnappings and abductions targeting cryptocurrency holders are increasing in France, and resold data files make it easy for criminals to locate potential targets.
However, it remains difficult for most investors to do without a tool. With the automatic exchange of information between platforms and the tax authorities, an approximate declaration of crypto capital gains is easier to spot. To estimate in advance the amount due on your capital gains, you can use our crypto tax calculator.
Choosing a tax assistant therefore depends on more than just its price or the number of platforms it supports: how it collects, stores, and protects your data is just as important.
Below, we present the security criteria to check, using the concrete example of CoinTracking, a crypto tax assistant developed in Germany since 2012 and used by more than 2.2 million active users, along with best practices to follow on your end.
Security criteria to check before choosing
1. Be able to sign up without providing personal data
This is the most decisive criterion and also the rarest: the vast majority of tax assistants require at least an email address to create an account. That is enough to link a transaction history to an identity.
The principle is simple: data that is not collected cannot leak. Your usual email address is probably already included in other data leaks, along with your name, phone number, or address. If it also appears in a tax assistant's database, an attacker could connect your identity to substantial crypto holdings. Without an email address, making that connection becomes impossible: they would have only anonymous transaction histories, which cannot be used to target an individual.
CoinTracking lets you create an account using just a username and password, without an email address, phone number, or bank card for the free plan. To our knowledge, no other major crypto tax assistant currently offers completely anonymous registration. CoinTracking also says it performs statistical calculations without using personal data.
To make full use of this option, choose a username you do not use anywhere else and a unique password. If you still prefer to provide an email address, for example to recover your account, create one specifically for this purpose with a privacy-focused service such as Proton Mail.
On CoinTracking, an email address is optional: a username and password are enough
2. Read-only access to your platforms
Connecting a crypto exchange to a tax assistant is generally done using an API key. It must be configured as read-only, with no trading or withdrawal permissions: the tool can then view your history without being able to move your funds. Also check how these keys are stored.
CoinTracking accepts only read-only API keys. After they are imported, they are encrypted on its servers. According to CoinTracking, even its employees cannot view them. For manual CSV file imports, the platform extracts the transactions but does not keep the file.
A read-only API key lets you view transaction history without being able to move funds
3. Hosting and the legal framework
Where data is stored determines which rules apply to it. If it is hosted in the European Union, it is subject to the GDPR, which governs its collection, retention and deletion.
CoinTracking's servers are located exclusively in Germany and are therefore subject to the GDPR as well as Germany's data protection law. All sensitive data is encrypted, and the platform uses SSL/TLS encryption for data in transit.
CoinTracking's servers are hosted in Germany
4. Certifications that have been audited
A website's simple claim that it is secure is not proof. A certification such as ISO/IEC 27001 offers a stronger guarantee: it confirms that the company applies an information security management system, including risk assessment, controls and continuous improvement, verified by an independent auditor. However, check that the certification is held by the company itself, not just its hosting provider.
CoinTracking is certified to ISO/IEC 27001 at the company-wide level, and the certificate can be viewed on its website. This certification does not cover only the platform's technical infrastructure: it also covers internal organization, including regular security training for teams and limiting access to systems to what each employee's role requires.
CoinTracking is certified to ISO/IEC 27001
5. Securing your account
Integrated two-factor authentication (2FA) using a dedicated app protects your account even if your password is compromised. Some services allow it only when signing in through Google or Apple, which once again ties the account to an identity.
CoinTracking offers integrated two-factor authentication, compatible with apps such as Google Authenticator or Authy. This protection is crucial for securing your account: activate it as soon as possible.
6. Deleting and exporting your data
When you stop using a tax assistant for your cryptocurrencies, you should be able to retrieve your data and then have it permanently deleted. Unfortunately, this point is often overlooked. According to their privacy policies, some services retain data for several months after an account is closed, in backups or archives. Deletion may also require contacting support instead of clicking a button. During this period, your data remains exposed to the risk of a leak.
Before choosing a tax assistant or any other service related to your cryptocurrencies, check its privacy policy to see how long data is retained after an account is closed, how deletion works and whether you can export your history.
On CoinTracking, deletion is immediate and permanent, and you can trigger it at any time. The platform states that it deletes all transactions, wallet information and API keys, without retaining any residual data. You can also export your data before leaving, in accordance with the right to data portability under the GDPR.
Good practices to follow on your end
The platform's measures are not enough if your account is poorly protected. Here are some good practices to greatly reduce the risks:
- Protect your anonymity: if the tool allows it, do not provide an email address or phone number. Otherwise, use a dedicated address that does not include your first or last name;
- Choose a neutral username that is not linked to your other online accounts;
- Avoid quick sign-in through Google or Apple, which links the account to your identity;
- Use a unique password, generated and stored in a password manager;
- Enable 2FA using an app (Google Authenticator or Authy) rather than SMS to avoid SIM-swap attacks;
- Create a separate API key for each tool, with read-only access, and revoke it if you stop using it;
- If your bank allows it, pay with a temporary bank card. Revolut, for example, lets you create temporary, single-use cards;
- Beware of phishing and communications you may receive by email, SMS, or other means. Check the sender's legitimacy and do not click on any links. Go directly to the genuine website of the tool or platform to verify the information mentioned in the message;
- Always delete accounts for tools you no longer use.
Other criteria for choosing your tax assistant
Security does not exempt you from checking the quality of the capital gains calculation for your cryptocurrencies. In France, the tool must apply the method set out in Article 150 VH bis of the General Tax Code, which is based on the total value of the portfolio. CoinTracking applies this method for France and automatically generates form 2086.
The tool should also offer checking features, such as detecting duplicates and transfers whose incoming or outgoing transaction could not be found. Most incorrect reports result from incomplete history rather than a calculation error.
Preview of the CoinTracking interface
The pricing model also deserves your attention. At CoinTracking, transaction limits are cumulative over the account's entire lifetime, rather than calculated per year, so a single subscription can cover several tax years. To learn more about the features and pricing, read our full review of CoinTracking. To compare the main solutions on the market, see our comparison of crypto tax assistants.
In brief: criteria to apply when choosing your tax assistant
To compare tax assistants, here are the questions to ask yourself and the answers for CoinTracking:
To check these criteria for yourself, CoinTracking offers a free 7-day trial with unlimited imports and no bank card required. Using our link gives you a 10% lifetime discount on paid plans, excluding the lifetime license and promotions. 👇
