Loading...
Loading...
Send EIN, TIN, or other tax identification numbers securely with self-destructing links.
Tax identifiers cluster under the IRS umbrella term TIN but split into distinct objects. An EIN is a nine-digit Employer Identification Number assigned to a business entity on Form SS-4. An ITIN is issued via Form W-7 to non-resident aliens and dependents who owe US tax but cannot obtain an SSN. An ATIN covers pending adoptions; a PTIN identifies paid preparers. Each lives in a different threat model.
Vendor onboarding email is where most of these numbers leak. AP departments request a Form W-9 (US persons) or W-8BEN/W-8BEN-E (foreign individuals or entities) as a PDF reply, then file it in a NetSuite, Coupa, or SAP Ariba vendor master internal users can query. The W-9 prints the TIN beneath a signature block any clerk can read. The pattern repeats abroad — UK UTR, Canadian Business Number, EU VAT registration — pasted into procurement tickets.
PasteOnce isolates the identifier from the form. The vendor returns the W-9 or W-8 with the TIN field blank and sends the digits through a one-time link to a named AP contact, who types the value into the ERP record exactly once. The encrypted blob never reaches an Outlook .pst, a procurement attachment store, or a SharePoint folder.
Client-side encrypted. We can't see your data.
Your data is encrypted in your browser before it leaves your device.
Messages are automatically deleted after being read once.
We never see your data. Only encrypted blobs pass through our servers.
Links work exactly once. Refresh the page and it's gone forever.
Your sensitive data is encrypted in your browser using AES-256-GCM. The encryption key is generated randomly and never sent to our servers.
Only the encrypted blob is stored in our database, with an automatic expiration time. We literally cannot read your data.
When your recipient opens the link, the encrypted data is fetched and immediately deleted from our servers using an atomic Redis GETDEL. The key in the URL hash decrypts the message in their browser.
Email the unsigned W-9 or W-8BEN-E with the TIN field deliberately empty, then deliver the digits through a one-time link to a named contact. The vendor master entry consolidates them once; no archived email holds both signature and identifier together.
Payers can validate up to 100,000 TIN-and-name combinations against IRS records through e-Services TIN Matching. Confirming before persisting avoids a transposed digit that later triggers backup withholding under section 3406.
Sole proprietors are entitled to obtain an EIN even when permitted to file under their SSN. For a freelancer working with multiple clients, an EIN replaces the SSN on every W-9 and meaningfully cuts blast radius. Apply at irs.gov/ein.
Set a vendor-master policy that purges raw TIN strings after the seven-year IRS record-keeping minimum. Many ERP systems retain them indefinitely by default. A NetSuite saved-search or Coupa retention rule trims long-tail exposure.
A Berlin designer onboarding to a US studio returns the W-8BEN with treaty-country and certification fields completed but the foreign tax identifying number (her German Steuer-IdNr) blank, then sends the eleven-digit value to the AP analyst via a one-time link.
An Irish SaaS supplier gives a French B2B customer its IE-prefixed VAT registration so the buyer can apply the reverse-charge mechanism on the invoice. Rather than dropping the string into a procurement-portal note, the supplier transmits it through PasteOnce.
An applicant filing for an ITIN through a Certified Acceptance Agent shares a passport number, foreign tax ID, and prior-year US filing details with the CAA before the in-person verification step. The CAA reviews the typed values via a one-time link.
An EIN for a public reporting company is effectively public — it sits on the cover of every 10-K and 10-Q. That does not make broadcasting it safe. Trade-credit applications and merchant-cash-advance shops underwrite on the EIN plus an officer name.
TIN is the umbrella the IRS uses across all taxpayer identifiers. An EIN identifies a business entity and is requested on Form SS-4. An ITIN identifies an individual ineligible for an SSN, applied for on Form W-7. Each maps to a different form — W-9 for US persons, W-8 for foreign filers.
If a client pays you 600 dollars or more in a calendar year for services, they need a TIN to issue Form 1099-NEC and avoid 24 percent backup withholding under section 3406. Outside that threshold — a marketplace signup, a cold-outreach RFP — confirm the regulatory basis first.
The IRS does not directly receive most W-9 forms — they live between vendor and payer. Publication 1281 says the payer must retain a signed W-9 (electronic signatures acceptable under 31.3406(h)-3). Splitting form delivery from TIN delivery is compatible with that rule.