UK GDPR and ICO
We are registered with the Information Commissioner's Office and we process personal data only to the extent we need to prepare and transmit your statutory accounts and Corporation Tax return. Full detail in the Privacy Policy.
Encrypted in transit
Every request between your browser, our service, HMRC and Companies House uses HTTPS with TLS 1.2 or higher.
Passwordless sign-in
We authenticate you with a single-use magic link sent to your email, there is no password for an attacker to phish or steal. The session that keeps you signed in expires automatically.
Your Companies House Authentication Code
The 6-character code you provide at company binding is stored in our UK Postgres database under restricted application-level access. It is used only to transmit returns on the company's behalf, never shared, and never displayed back to you.
Backups
Every day we make a copy of our database and encrypt it with AES-256-GCM on our own server. The encrypted copy is kept on that server and also sent to Google Drive, so we still have it if the server is lost. Our server logs are encrypted and copied to Google Drive in the same way. Google Drive does not let us choose which country it stores files in, so these copies may be held outside the UK, including in the United States. They are encrypted before they leave our server.
Hosting
Our database and application servers are hosted by Hostinger in London. The only copies kept anywhere else are the encrypted backups and logs described above.
Engineer access
Only a small number of named engineers can reach our live servers.
How long we keep your data
Filed returns, their transactions, the record of what happened on each return and the record of when you signed in are kept for six years from the end of the accounting period, because the law says filing records must be kept, then deleted. Payments, support messages and the details of a deleted account are also kept for six years, then deleted. Backups and server logs are thinned as they age: we keep every day for 30 days, then one a week, one a month and one a year, and the last copies are deleted after about 7 years. The Privacy Policy has the full list.
Who else touches your data
HMRC (receives your Corporation Tax return), Companies House (receives your accounts), Stripe (payment processor), Resend (sends your sign-in links and some support emails), Google (Gmail sends your filing receipts, with your filed return attached, and other emails about your filings; Google Drive holds our encrypted backups and logs; Gemini is the AI that reads uploaded statements and helps sort your transactions; bank account numbers and sort codes are removed from the sorting text before it is sent, but a PDF or photo statement is read whole, account details included), Telegram (passes the messages you send through the support chat or feedback form to our support team), and Hostinger (our London hosting). The Privacy Policy carries the full list and the lawful bases.
If something goes wrong
In the event of a personal data breach we will notify the Information Commissioner's Office within 72 hours of becoming aware, as the UK GDPR requires. If you are personally affected we will email you directly with what happened, what data was involved, what we are doing about it, and what we recommend you do.
Your data, your rights
You can ask for a copy of the personal data we hold, correct it, or ask us to delete it (subject to the HMRC retention obligation above). Email [email protected], we respond within one month, as the UK GDPR requires. Full detail in the Privacy Policy.
Reporting a vulnerability
Found something we should know about? Email [email protected]. We acknowledge within one working day.
Questions on any of the above? Get in touch.