Canada Revenue Agency
Symbol of the Government of Canada


Security requires a partnership between two parties; in this case, the Canada Revenue Agency and you, the electronic filer.

The Canada Revenue Agency (CRA)

We permit only approved participants to electronically file income tax returns.

Personal and financial information must be transmitted to us in an encrypted format. Encryption is a way of encoding information before it is transmitted over the Internet. This ensures that no unauthorized party can alter or view the data.

We also ensure that all personal and financial information is stored securely in our computers. We use state-of-the-art encryption technology and sophisticated security techniques to protect this site at all times.

We have made every possible effort to ensure the safety and integrity of transactions on our Web site. However, the Internet is a public network and, as a result, is outside our control.

The electronic filer

If you want to transmit your clients' returns electronically, you must first register or renew on an annual basis your participation in EFILE with the CRA. Once the application or the renewal has been accepted, a confirmation page will display an EFILE number and password. These two pieces of identification make up an electronic signature required to access our confidential areas and services.

You also have to use approved security protocols to access our site. Data from your computer must be encrypted before being sent. This changes your data into a format that can be safely transmitted over the Internet. Once the data is encrypted, it cannot be read until it reaches its destination and is decrypted, using an encryption key.

In simple terms, the information from your tax return is broken down into small packages of information called packets, and Transport Layer Security (TLS) encrypts each packet. These encrypted packets are sent into the Internet separately, like pieces of a puzzle, each individually addressed. Once they've all reached the safety of our secure Web server, they're reassembled and decrypted.


As an electronic filer, you can help ensure your clients' income tax information remains confidential:

  • Keep your EFILE number and password secret. Notify the EFILE helpdesk immediately if you believe your password has been compromised.

  • If you leave your computer on after completing activities in an encrypted area of the site, clear the cache and turn off and restart the browser. This eliminates any copies of Web pages that may have been stored on your computer's hard drive. Remember, information stored in the browser cache is not encrypted.
    • If you are using Netscape Navigator, clear both your browser's disc cache and memory cache.
    • If you are using Internet Explorer, clear your disc cache, then shut down and restart your browser.

  • Unless you are using a firewall to prevent hackers from getting personal information from your hard drive, we suggest you remove any personal information, such as client tax information, from your hard drive and store it on diskette or CD.

    Note that a firewall may not protect you if you install peer-to-peer networking products, like those used at some popular Internet music sharing Web sites. In that case, moving personal data off your hard drive is the best option. As a minimal precaution, ensure that you are not storing any personal data in a shared folder.

    You might need to change the setting on your firewall to allow communications between our server and your computer.

  • Never send confidential information such as your client's SIN via Internet email. Our Internet email does not have secure transmission capabilities.

  • Dispose of all documents properly to protect your clients' confidentiality.