CIS software security

Your Gateway login goes to HMRC, not into our database.

What happens to your login, your sign-in and your firm's records, in plain words.

Your Government Gateway login is used once, then dropped

When you verify subbies or file a return, you type your Government Gateway user ID and password. They go to HMRC for that one request. They aren't saved in our database, our logs, error reports or analytics. A test in our code checks that no table ever holds them.

You file with your own login, so you don't appoint us as your agent with HMRC. If you want, your browser or password manager can save the login on your own device and fill it in next time.

Sign in with a link, not a password

We email you a sign-in link. It works once and runs out after 15 minutes, so there's no password of ours for you to remember or for anyone to guess.

If you lose a phone or used a shared computer, the Sign out on every device button in your account ends every session at once.

Each firm's records are walled off

Every page and every action checks who you're signed in as and which firm you're looking at, before it reads or saves anything. A link to another firm's subbie or return shows nothing.

In the database, row level security is switched on for every table, and the public database interface has no access to them.

A locked copy of every return

Each return you file is kept as it was sent, with HMRC's receipt (the IRmark). If a payment in that month changes later, it shows as a difference against what was filed.

Encrypted connections and no trackers

The site only works over an encrypted connection, and tells your browser to insist on one (HSTS). Other websites can't show our pages inside theirs, which stops a fake page wrapping the filing form.

There are no analytics, trackers or third-party scripts on the site or in the app. The only code that runs in your browser is ours.

Where your records are kept

Your records are stored in a database hosted by Supabase in the EU (Ireland). The site is hosted by Vercel. The privacy notice lists everyone else who sees any of it, and why.

Your records are yours to take

Download your subbies, payments, returns and verifications as CSV files, and your statements as PDFs, whenever you like. Export still works after a trial or plan ends.