Security & your data

• Users can use passkeys, security keys, authenticator-app MFA, and recovery codes.
• Protected HMRC and administrative actions can require recent identity verification.
• Role-based access and workspace context restrict who can see account, client, billing, support, and HMRC areas.

• Stored HMRC access tokens and sensitive taxpayer identifiers use application-level encryption. This statement does not imply that every field or exported file is encrypted.
• Sensitive identifiers are masked in normal screens where possible.
• Operational records and exports are designed to avoid exposing raw OAuth tokens, passwords, auth codes, card numbers, or full NINOs.

Taxpayer and client users are scoped to their own account or authorised workspace data. Client portal access is read-only. Direct taxpayer accounts have separate permissions for their own supported workflows.

• Supported spreadsheet types are checked before processing.
• Password-protected, encrypted, macro-enabled, unsafe, oversized, or unsupported files are rejected or blocked according to the upload policy.
• The upload policy requires a successful external malware scan for live service uploads. When the required scan cannot complete, the upload is blocked. A file check cannot guarantee that every threat will be detected.

• QuarterLink requires HMRC authority, relevant obligations, readiness checks, duplicate-submission protection, role/module access, and MFA where required before supported submissions.
• Trial users cannot make real live HMRC submissions.
• Live HMRC submission remains blocked unless account and workflow controls allow it.
• HMRC fraud-prevention headers use request and browser context where required by HMRC.

• Important HMRC, import, submission, billing, support, and administrative actions are recorded where required.
• Submission evidence is retained so users can review workflow history and supporting records.
• HMRC reference details help trace events without exposing token material.

Stripe handles checkout, payment methods, billing portal, invoice payment, retries, payment security, and hosted payment pages. QuarterLink stores billing references and status records, not card numbers.

Support access is temporary, controlled, and recorded. Support may need safe account, import, billing, or HMRC reference details to diagnose issues, but should not need raw passwords, raw OAuth tokens, card numbers, or full sensitive identifiers for normal support.

If you believe your account, HMRC connection, billing, or taxpayer data is at risk, contact [email protected] with the account email, page, approximate time, and any safe reference or support ticket reference you can see.