No wallet connection. Ever.
The entire product works from one input: a transaction hash. That single design decision removes most of the risk surface a crypto tool can have — there is nothing to connect, nothing to sign, and nothing to custody.
Hash-only by design
The API, the MCP server, the Classification Explorer, and the Chrome extension all take a transaction hash and return a classification. No surface asks for a wallet connection, an address import, a seed phrase, or a signature — not optionally, not ever. Classification reads public on-chain data for the transaction you name, and nothing else.
Why this matters: a tool that connects to your wallet holds permissions; a tool that imports your addresses holds a map of your holdings. A tool that reads one public transaction at a time holds neither. For firms, that means running client work through CryptoTaxEdge adds no custody or signing risk to the engagement.
Keys, payments, and the boring parts
API keys are stored as SHA-256 hashes — the key itself is shown once at creation and never stored in plain text; revocation takes effect immediately, no redeploy. Billing runs entirely on Stripe, so card details never touch CryptoTaxEdge systems. The public site ships strict transport security and frame-ancestors protections on every response.
The honesty contract is a security property too
When the engine cannot classify a transaction confidently, it returns needs_review with taxable: null rather than a confident-looking guess — and an upstream failure is returned as a 502, never dressed up as a classification. Uncertainty is surfaced, not hidden. The same posture applies here: if you believe you have found a security issue, write to hello@cryptotaxedge.com and you will get a direct answer.
Data handling details live in the privacy policy.
Not tax advice. CryptoTaxEdge is software, not a licensed tax advisor. Classifications are informational only. Verify results and consult a qualified tax professional before filing.