We'd like to use Google Analytics cookies to see how our website is used. See our cookie notice.

Skip to content
Taxley.
Get started

Trust & data

Security & data protection

How we handle your company and personal data.

How does Taxley protect my data?

Taxley encrypts personal and financial identifiers in its database and the documents it generates on disk, serves all traffic over TLS, keeps API keys and gateway credentials out of the codebase, and records key actions in an append-only audit log with hashed IP addresses. You can export or permanently delete your data at any time.

  • Encryption at rest

    Personal and financial identifiers (UTR, registered office, director name) are encrypted in the database, and the documents we generate (CT600 XML, iXBRL accounts and computations, submission envelopes) are encrypted on disk. The Government Gateway password is removed before any envelope is stored; the Gateway user ID stays in the envelope, encrypted.

  • Encryption in transit

    All traffic is served over TLS. Sessions are encrypted, and production enforces HTTPS.

  • Least-privilege secrets

    API keys and gateway credentials are never stored in the codebase; they are read from the server environment. Nothing is sent to HMRC or Companies House until you choose to file from your filing page.

  • Audit trail

    Key actions are recorded in an append-only audit log. We never log credentials or full PII — only the action, the affected record and a hashed IP.

  • Your GDPR rights

    You can export everything we hold about you as a JSON file, and permanently delete your account and all associated data and documents, from your account at any time, subject to statutory retention.

  • Standards we build around

    HMRC's GovTalk / Transaction Engine submission protocol, the FRC inline-XBRL (iXBRL) taxonomies for FRS 105 / FRS 102, the CT600 schema and HMRC's business rules. Each return is checked against them before it is sent. Taxley has filed live with HMRC since June 2026 and with Companies House since September 2026.

Where is my data stored?

Your data is stored on a virtual private server run by Hostinger, located in London in the United Kingdom. Hostinger also delivers Taxley's email and is engaged under contract only to run the service. Personal identifiers and the documents we generate are encrypted on that server.

We share it only with HMRC and Companies House when you file, Stripe for payment, and where the law requires. We never sell it or use it for advertising.

Can I turn on two-factor sign-in?

Yes. Two-factor sign-in is optional and open to every customer. Switch it on in your account settings with an authenticator app on your phone; Taxley then asks for a 6-digit code from it each time you sign in, so someone who learns your password still cannot get in.

You also get eight single-use recovery codes, and we email you whenever two-factor sign-in changes. Passwords are stored only as a one-way hash, and sign-in attempts are rate-limited.

What happens to my Government Gateway password?

Taxley uses your Government Gateway user ID and password only to send your return to HMRC, and never keeps your password. It is never saved to your account or filing. While the return is being sent it is held encrypted in the submission queue; if sending fails, that encrypted record is deleted within three days.

How does Taxley file with HMRC?

Taxley sends your Company Tax Return to HMRC through its Government Gateway, using Taxley's own software vendor ID. You submit with the company's Government Gateway user ID and password, or an agent's for practices. Taxley never saves the password to your account or filing; it is held encrypted only while the return is being sent.

Does Taxley store my card details?

No. Card payments are handled by Stripe. You type your card details into Stripe's own payment form on the checkout page, and they go straight to Stripe. Taxley's database holds only the amount, the payment status and a Stripe reference, never your card number.

How long does Taxley keep my data?

Filed returns and tax records are generally kept for six years from the end of the accounting period, in line with HMRC requirements. Account data is kept while your account is open. In website visit logs, raw IP addresses are deleted after 30 days and page-view records after 90 days.

Deleting your account deletes every document we generated. Where you paid for a return or HMRC accepted one, UK law requires a minimal, anonymised record of it to be kept for six years; otherwise the whole account is deleted.

How do I report a security issue?

Email support@taxley.co.uk, the contact published in our security.txt file, with what you found and how to reproduce it. If a personal-data breach is likely to put your rights at risk, we tell the ICO within 72 hours where required, and affected users without undue delay where the risk is high.

Data protection. Taxley UK LLP is registered with the Information Commissioner's Office (ICO), registration number ZC263823, and keeps the data-protection records expected of a UK service that handles company and tax information, including a data-protection impact assessment and decisions on where your data is stored.

See also our Privacy policy and Cookie notice.