Security

Your Government Gateway user ID and password, your Companies House authentication code, and your directors' Companies House personal codes are used once, in memory, at the moment you instruct a submission. They are never written to our database or logs — there is deliberately nowhere in the system to put them. If you need to file again, you enter them again.

Card details are the same: they go straight to Stripe. We never see or hold a card number.

The application runs on Google Cloud Run in London, with the database and document storage on Supabase in London. Traffic is encrypted in transit (TLS); data is encrypted at rest by those providers. Error monitoring and, where enabled, AI processing may run outside the UK under the transfer safeguards described in our privacy policy.

Passwords are hashed with argon2. Sessions are httpOnly cookies stored server-side as hashes, revoked on logout, and cleared on other devices when you change your password. Two-factor authentication (any authenticator app) is available on your account page, and we recommend it for any account that can file.

Paying, filing and exporting your data all require a confirmed email address. Signing up never reveals whether an address already has an account.

Every record — companies, filings, figures, documents, receipts, workspaces — is scoped to the account that owns it, enforced in the application and again by row-level security in the database. That isolation is covered by automated tests that run on every deploy, and it is the first thing an independent tester will be asked to attack.

A submission is recorded before it goes to the government, so a network failure can never quietly produce a duplicate filing. If an outcome is genuinely unknown, we say so and never silently resubmit. The exact figures behind every submission are frozen at the moment of filing, so an amendment can never rewrite what was originally sent. Every filing action is written to an audit log.

The database and stored documents are backed up nightly. Restores are rehearsed rather than assumed — we treat a backup that has never been restored as a hope, not a backup.

An independent penetration test is planned before general availability, and this page will name the date and the firm once it is complete and remediated. Assist's AI features are in private beta and are not part of the generally available service. We would rather list these here than imply assurance we don't have.

If you believe you've found a security problem, email security@gotaxes.co.uk. Please give us a reasonable chance to fix it before disclosing it publicly. We will acknowledge your report, keep you updated, and credit you if you'd like. Please don't test against other people's accounts or real filings — ask us and we'll set you up with test data.