Built UK/EU. Encrypted, isolated, audited.

Sign-in is passwordless and access follows least privilege.

• Passwordless sign-in — magic-link and single sign-on (Google / Microsoft). No passwords are stored.
• Role-based access: only firm owners manage billing and team seats, delete the firm, or permanently delete a filed calculation or a client that has one.
• Sensitive actions are rate-limited to deter abuse.
• Production access is tightly scoped, and non-production test paths cannot run in production.

Client data is encrypted everywhere it lives and moves.

• Encrypted in transit with modern TLS, and encrypted at rest.
• Client records (names, dates of birth, NI numbers, addresses and emails) and plan numbers are additionally encrypted at the application layer (AES-256) before they reach the database. Details read from an uploaded document are encrypted at rest only; /data-minimisation explains.
• The calculation engine and the audit record work from an anonymised client reference — never the underlying personal data. The PDF annex is prepared in the client’s name.
• Uploaded documents are held in encrypted storage.

Your firm’s data is strictly separated from every other firm’s.

• Per-firm isolation is enforced at the database layer, so one firm can never read another firm’s records.
• The application independently re-checks ownership on every request, as defence in depth.
• Isolation is verified automatically and continuously.

We hold the minimum a defensible calculation needs, and delete the rest quickly.

• Uploaded source documents are scheduled for deletion after 24 hours, with hourly cleanup and retries.
• Your firm controls client and calculation deletion, policy archiving, and how long filed calculations are kept (six years by default). You are the controller of your client data; we are the processor.
• Owner-confirmed firm erasure, with background cleanup tracked to completion.
• Data-minimisation by design — we never require client names, NI numbers or addresses to run a calculation.
• Machine-readable data export on demand.
• Before a privacy choice, product measurement is limited to cookieless public-surface counters with no persistent identifier. Account-linked analytics require explicit consent. Anonymous, masked browser session replay also requires consent and is limited to queryless public pages in production; it is disabled on authenticated and client workspace pages.
• Processor-side client-data breaches are reported to the affected firm without undue delay; controller-side ICO notifications follow the Article 33 risk test and 72-hour window.
• Written Data Processing Agreements in place with our providers.

The application is built so untrusted input can’t do harm.

• All input is validated against strict schemas at the boundary.
• Database access is parameterised — no injection through string-built queries.
• Uploaded files and firm branding are sanitised before they are ever rendered.
• Payment webhooks are signature-verified.
• Secrets are never stored in source code, and secret comparisons are timing-safe.

Every figure admitted to a client file keeps the inputs and rule versions needed to check it — that’s the core of the product.

• Sensitive actions are recorded in a firm activity log that no one in the firm can edit or delete. Entries are changed only to remove personal details, such as a deleted account’s link to its entries, email-address hashes, and a closed firm’s IP addresses and browser details.
• Every calculation filed as evidence retains its full inputs, the versioned rules and the result with its recorded steps. Line-by-line working that is not stored, such as the annual allowance charge by band, is re-derived from those inputs and the retained rules version; a replay reports any difference or unavailable version.
• The calculation engine is deterministic and checked against a public table of regression cases with their sources. Cases it cannot work are refused, and where HMRC’s guidance is ambiguous a documented reading is applied and kept on record, available on request — see /trust.

Deliberate about recovery and export.

• Managed database with daily backups, which we aim to keep for 7 days.
• Portable data export at any time.
• Draft annexes are re-generated from the saved calculation while it remains available and passes its checks. A filed annex is served only from its stored copy and is never re-generated.