Security
Checked line by line.
Not just described as secure.
In August 2026 we ran a full internal security and fault audit of the source code and the database. Every finding was fixed, verified and covered by a test, and the checks now run automatically on every change. A formal third-party penetration test is planned and has not happened yet. We will say so until it has.
- UK hosted and encrypted
- No client money ever held
- Per-firm data isolation
- Real double-entry, FRS 102
- Built for Making Tax Digital
What we checked, and what we found
- Every table that holds your data, to confirm one customer cannot reach another customer's books, and one practice cannot reach another practice's clients.
- Sign-in, sessions and who is allowed to do what, including the actions only an owner or an accountant should be able to take.
- The server and edge code that runs behind the app, and the way passwords, keys and connections to HMRC and your bank feeds are stored.
- The numbers themselves: that the ledger balances, that posted history cannot be quietly altered and that the reports agree with it.
- Two serious problems were found and closed: one that could have let the wrong client's data be reached, and one gap between practices. Both are fixed, verified and now covered by tests that run on every change.
This was our own work, done properly and written down. It was not a third-party audit, a penetration test, ISO certification or a SOC report, and we will not describe it as one. A formal external penetration test is planned.
UK hosted and encrypted
Your books are hosted in AWS London. Data is encrypted in transit with TLS and encrypted at rest, and backups are encrypted too. Nothing about your ledger leaves the UK region in normal operation.
No client money ever held
We are not a payment institution and we do not want to be. We never hold your money and we never hold your client's money. Pay by Bank will settle bank to bank over FCA-authorised open banking rails straight into your account. It is not live yet.
Per-firm data isolation
Every table holding customer data is protected by row level security enforced in the database rather than in application code. One customer cannot read or write another customer's books, and a practice can only reach the clients it is engaged on, even if the app has a bug.
The data access log
Reads are recorded, not just writes. When a member of your accountant's team opens your books, that access is logged with who, what and when, and you can review it. Access is granted by you and can be removed by you.
The guard log
Privileged and administrative actions are written to an immutable guard log that cannot be edited or deleted after the fact. Seats are scoped, so staff only reach the clients and areas they have been given.
Ledger integrity
Real double-entry with automated invariant checks that run continuously. Journals must balance, statutory records are uniquely constrained, and posted history cannot be quietly rewritten.
Anything automatic fails closed
When bank feeds go live, messages sent to us by the feed provider will be signed and checked before we act on them. Scheduled jobs need a secret to run. If a signature or a secret is missing, the job stops rather than guessing.
Tested again on every change
The security and isolation checks written during the August 2026 audit run automatically every time we change the code. A change that would let one customer see another customer's data stops the release.
If something goes wrong, you hear it from us.
We investigate every suspected incident, contain it first and then tell you what happened, what was affected and what we changed. Where a personal data breach is notifiable, we notify the ICO within the statutory 72 hours and tell affected customers without undue delay.
If you are a customer or a security researcher and you suspect a vulnerability, email security@taxchad.com. We acknowledge every report and keep you updated while we investigate.
The HMRC clause
If an incident could have affected a submission made to HMRC on your behalf, or the figures behind one, we tell you in plain terms which returns are in scope and we help you correct them. We will not let a filing sit wrong because it is awkward to mention.
TaxChad is built for Making Tax Digital and files VAT to HMRC under it. We are not HMRC recognised, and we will not say we are until we are.
Bring the awkward questions.
Isolation, retention, sub-processors, exit and data portability. We would rather answer them before you move a client than after.