TaxChad Technical Architecture · September 2026
TaxChad · Technical Architecture · 19 September 2026

A ledger is a promise about arithmetic.

This is the engineering documentation for the TaxChad platform. It sets out what has actually been built, how it is put together, where the hard guarantees live, and what is still missing. Every number on this page was read from the live database and the repository, not estimated.

Bank data in Your rule Balanced journal Report HMRC
338,064
Lines of TypeScript in the application
233
Database tables, row-level security on every one
4,042
Automated tests across 358 test files
555
Database migrations since May 2026
Architecture01 / 09
02 The system at a glance

One application, five layers, no hidden middleware.

Everything below is either code in one repository or a managed service with a data processing agreement behind it. There is no second system, no offshore team's codebase, and no undocumented service in the path between a customer's bank line and a filed return.

USERS EDGE AND HOSTING APPLICATION DATA AND AUTH EXTERNAL SERVICES Company owner browser, mobile web Accountant PowerStone firm console Chad assistant MCP, caller's own token React 19 · TanStack Router Tailwind 4 · shadcn/ui Cloudflare TLS, CDN, edge AWS, London eu-west-2 TanStack Start Bun, Nitro, SSR no client-side database access, ever Server functions 111 modules, 463 endpoints Authorisation layer session, firm and client scope Rules engine deterministic, first match wins Posting core double entry, both currencies Tax engines VAT, CT, SA103/105/106, CIS, CGT Reporting and exports TB, P&L, balance sheet, PDF MCP server runs as the caller, RLS enforced PostgreSQL 233 tables, 3,109 columns 491 RLS policies Integrity guards 269 triggers, 198 checks 426 foreign keys Auth sessions, MFA step-up Storage 8 private buckets Audit trails activity, guard, HMRC, payments pg_cron · pgmq · vault schedules, queues, secrets 246 database functions 595 indexes HMRC MTD VAT and ITSA, via relay Companies House Finexer open banking, FCA rails Stripe · GoCardless subscription billing AWS Textract document text extraction AI gateway extraction only, never coding FX rates daily, with fallback source CONTINUOUS INTEGRATION Every push replays the golden client books, the full ledger invariant suite and two database tenant-isolation gates. typecheck · lint ratchets · build · 4,042 tests SCHEDULED WORK · 16 JOBS IN pg_cron Nightly encrypted backup · ledger invariant sweep · FX ingest and freshness check · HMRC token expiry watch · Companies House sweep · obligation and invoice reminders · recurring invoices · receipt matching · payroll billing · fiscal year creation · Finexer webhook monitor. DISASTER RECOVERY Nightly snapshot of every table, the auth users and all storage objects. AES-256-GCM per segment, keys wrapped with a 4096-bit RSA key held only by the founder, off-site to a separate AWS account. THE LINE THAT MATTERS Software produces the numbers. A regulated human being signs them. The platform codes, posts, reconciles and files. Accounts and Corporation Tax are reviewed and filed by a CIMA-regulated accountant at PowerStone. The software layer and the regulated layer are separate companies, separate contracts, separate liability.
TaxChad platform · architecture and deployment · 19 September 2026
System diagram02 / 09
03 The stack

Boring where it should be boring.

Nothing here is exotic. Every choice in the stack is a mainstream, well-supported technology with a large hiring pool, because the interesting part of this business is the accounting logic, not the framework.

Front end
React 19, TypeScript, TanStack Router and TanStack Start, Tailwind 4, shadcn/ui on Radix primitives504 .tsx files, 309 shared components. One design system, one page frame, no second front end.
Server
TanStack Start server functions on Bun and Nitro, server-side rendered111 server-function modules exposing 463 endpoints. No separately deployed API service to keep in step.
Database
PostgreSQL on Supabase, with pg_cron, pgmq, pgcrypto, pgTAP and Supabase Vault233 tables, 595 indexes, 246 functions, 426 foreign keys, 198 check constraints.
Auth and storage
Supabase Auth with MFA step-up, eight private storage bucketsNo public bucket holds client documents. Every download is brokered by a server function.
Hosting
Lovable Cloud: Cloudflare edge in front of AWS in London (eu-west-2)Client ledger data stays in the UK region in normal operation.
Language surface
One language end to end: TypeScript, 338,064 lines under src1,132 files in 67 domain folders under src/lib, with a lint-enforced boundary that keeps domain code out of the root.
React 19TypeScript 5.8TanStack StartVite 7BunTailwind 4PostgreSQLSupabaseCloudflareAWS eu-west-2VitestpgTAPZodStripeGoCardlessAWS Textract
Stack03 / 09
04 Life of a transaction

What actually happens between a bank line and a filed return.

This is the path every pound takes through the system. It is worth reading slowly, because the design decisions that matter are all visible in it.

01

Data arrives

A bank line arrives by open banking feed, CSV, OFX or PDF statement. PDF and photo documents are text-extracted by AWS Textract or a language model, and the extracted rows are always shown to a human before anything is posted.

02

A rule is matched

The rules engine walks the client's rules in a total, reproducible order and takes the first one whose conditions all hold. Nothing is scored, guessed or learned. If no rule matches, the line stays uncoded and visible rather than being assigned a plausible answer.

03

VAT is split once

Where VAT applies, the tax is rounded once and the net is derived as the remainder, so net plus VAT always equals gross to the penny. A property test asserts this across thousands of random amounts and every VAT code.

04

A journal is posted

The posting core writes balanced double-entry journal lines. The application pre-checks them for a readable error message, and then the database refuses anything that does not balance, in the transaction currency and in the home currency, at commit time.

05

The ledger is swept

A nightly job replays the invariant suite across the whole ledger. Every guard rejection, in the app or in the database, is written to an insert-only guard log the accountant can read.

06

Reports are derived, not stored

Trial balance, profit and loss, balance sheet, VAT return and the tax computations are all derived from the ledger on read. There is no second set of numbers to fall out of step with the first.

07

A human reviews

The accountant starts at the trial balance, not the shoebox. Accounts and Corporation Tax are prepared and filed by a regulated person at PowerStone, under their practising certificate and their insurance.

08

It goes to HMRC

VAT and Self Assessment submissions leave through the MTD APIs with the fraud prevention headers HMRC requires, routed through a fixed-address relay so the vendor headers are truthful. Every call and its response is written to an audit log with credentials masked.

Lifecycle04 / 09
05 Design decisions

Six choices that shaped everything else.

01 · Determinism

The engine does not guess

Categorisation is a rules engine, not a model. Five match types, conditions combined with AND, a total ordering that falls through to the rule's own identifier so the answer is always the same. Run it twice on the same books and you get the same ledger.

02 · Guarantees in the database

Invariants that code cannot bypass

If a rule is a per-row truth, it becomes a database constraint, not a warning on a dashboard. Journals cannot be saved unbalanced. A journal line cannot point at another client's nominal. The trial balance is re-totalled at commit.

03 · One chart of accounts

Entity type is a flag, not a fork

Company, sole trader, landlord, VAT registered or not, all share one chart. Crossing the VAT threshold flips a boolean rather than migrating a chart. Every income and expense code carries its tax box, so a quarterly update is a grouping, not a rebuild.

04 · No public write API

One authenticated surface

There is no separately deployed API service and no public write endpoint. The application talks to itself through typed server functions, the assistant integration runs read-only as the calling user with row-level security applied, and webhooks are individually secret-checked.

05 · Software and advice stay apart

Two companies, on purpose

TaxChad Ltd is a software company. Regulated accountancy is delivered by PowerStone Accountants Ltd under its own licence, insurance and engagement letters. That separation is what makes the promise honest: software is software, and when you want a regulated opinion there is a named professional, a practising certificate and professional indemnity insurance standing behind it.

06 · Evidence over assertion

Show the value, not the claim

The standing rule in this codebase is that nobody accepts "done" or "secure" as an answer. Every security finding this year was surfaced by demanding the actual code or the actual value. That discipline is the reason the honest gaps below are written down at all.

Decisions05 / 09
06 Built, building, not built

Where the line actually is today.

Built and in production
Double-entry ledger with database-enforced integrity, deterministic rules engine, multi-currency with FRS 102 period-end retranslation, sales and purchase invoicing, bank import from feeds, CSV, OFX and PDF, VAT return preparation and submission, Corporation Tax computation, Self Assessment across trade, property, CIS, capital gains and foreign sources, fixed assets and depreciation, payroll billing, practice management for the accountant, drillable reporting, audit and data access logs, nightly off-site encrypted backups
In build now
Finexer open banking feeds moving from integration to live customers, Pay by Bank collection, MTD ITSA quarterly update flows, HMRC production credentials behind the fixed-address relay
HMRC recognition in TaxChad's own name, sole trader and landlord segments at scale, direct TaxCalc integration for accounts production, a formal third-party penetration test, a second engineer on the codebase
Not built, and we will say so

TaxChad is not HMRC recognised today and does not claim to be. There has been no third-party penetration test. Bank feeds are integrated but not yet carrying live customer volume. The restore path from an off-site backup has been proven to the point of decryption and row counts, but not yet by a full load into a scratch database. Each of these has an owner and a date, and each is described plainly in the pages that follow.

Status06 / 09
07 How it was built

One operator, one codebase, a lot of guard rails.

TaxChad was built by its founder working with AI coding agents under a strict operating contract, inside a working accountancy practice, against real client books. That is unusual, so it is worth being precise about what makes it safe rather than reckless.

What makes it hold together

  • Accounting truths are enforced by the database, so no agent, no refactor and no future engineer can quietly break them
  • Real client books are frozen as golden fixtures and replayed through the reporting core on every single push
  • Changes to ledger, VAT, HMRC, tax, FX and payroll code require a real commit message and an entry in a change ledger, enforced in CI
  • Two database-level tenant isolation suites run in CI and fail the build if a tenant boundary moves
  • Every recurring bug class has been turned into a guard rail rather than a lesson learned

What it costs us

  • Key person risk is real and concentrated in one founder who is both the domain expert and the operator
  • There is no second pair of engineering eyes on a pull request today
  • Some authorisation logic lives in application handlers rather than purely in the database, which is a standing review discipline rather than a solved problem
  • Documentation lives in the repository and in the founder's head in unequal measure
  • A second engineer on this codebase is as much a risk control as a capacity increase
Method07 / 09
08 Scale

The shape of the cost curve.

The honest answer on scale is a list of what breaks first. Nothing in this architecture has to be rebuilt to serve a few thousand companies, and the parts that will need attention are known and written down.

LayerWhere it goes under loadWhat we would do
Front end and server functionsStateless, rendered at the edge, scales horizontally with trafficNothing structural. Cost scales close to linearly with usage.
DatabaseA single Postgres instance is comfortable well past that for a ledger workload of this shapeVertical scale first, then read replicas for reporting. Tenant data is already firm-scoped, so sharding by firm is available and does not need a rewrite.
Document storage and OCRPer-document cost, the most usage-sensitive lineAlready metered per client. Extraction is cached and never repeated for an unchanged document.
Scheduled workNightly sweeps grow with the number of clientsJobs are already chunked and idempotent, with a queue extension in place for fan-out.
The regulated review layerThis is the real constraint, not the softwareAccountant capacity per client is the number that decides margin. It is a hiring and workflow question, which is exactly why the practice management side was built into the product rather than bolted on.
Scale08 / 09
09 Go deeper

The detail, five ways.

Each page below stands on its own and is written for a technical reader. If you want to send an engineer at this, send them here.

01

Ledger and data model

Double entry, the integrity guards that live in the database, multi-currency, the chart of accounts, and how 555 migrations were kept safe.

02

Security and tenancy

How one firm is kept out of another firm's books, what the two CI isolation gates actually assert, the audit trails, and the gaps we have not closed.

03

The engine

Exactly how a transaction is coded, why it is deterministic, where extraction models are allowed to touch the data, and the tax engines on top.

04

Integrations

HMRC, the fraud prevention header problem and how it was solved, open banking, payments, Companies House, FX, and every scheduled job.

05

Build and run

The CI pipeline gate by gate, golden fixtures, the change ledger, backups and disaster recovery, monitoring, and what we do when something breaks.

00

Security overview

The plain-English summary of how we handle your data, what has been audited, what has not, and how to report a vulnerability.

If the numbers are wrong, nothing else about this company matters. That is why the arithmetic is the part we made impossible to break.
Contents09 / 09
TaxChad is built and operated by TaxChad Ltd, company number 17346680, registered in England and Wales. This page describes the platform as built on 19 September 2026. Counts of tables, migrations, tests and lines of code were read from the live database and the repository on that date and move as the product does. Anything described as in build or planned is a statement of intent rather than a commitment. Regulated accountancy services are provided by PowerStone Accountants Ltd, a separate company, under its own licence and insurance. Nothing here is tax, legal or investment advice.