Security

Security-first by design

Built for UK practices handling sensitive client data — tenant isolation, guarded integrations, and audit trails you can stand behind.

Start free trialTalk to us
Tenant-scoped by defaultEncrypted at restImmutable audit trailIntegration gates

Tenant isolation

Your practice data never bleeds across firms.

  • User tenant context on every request
  • PostgreSQL row-level security contracts
  • Practice-scoped API boundaries
  • No cross-tenant queries in production paths

Encryption

Sensitive fields protected in production.

  • Application-level field encryption
  • Document storage encryption keys
  • Secrets via environment — never in code
  • Conservative key rotation posture

Authentication

Sessions hardened from day one.

  • HTTP-only secure cookies
  • JWT expiry & validation
  • bcrypt password hashing
  • Rate limits on auth routes

Billing

Stripe handled server-side only.

  • Stripe keys never in the browser
  • Webhook signature validation
  • Checkout tied to tenant accounts
  • Billing portal for self-serve

Audit

Every sensitive action logged.

  • Auth and access events
  • Billing state changes
  • Immutable event records
  • Export-ready audit trails

Integration gates

No false certification claims.

  • Third-party connections credential-gated
  • HMRC & CH blocked until configured
  • Live submission gates enforced
  • Conservative compliance positioning

Defense in depth

Four layers between your practice and the outside world — no single point of failure, no shortcuts on tenant boundaries.

Layer 01
ApplicationTenant context, RBAC and route guards on every write.
Active
Layer 02
API boundaryRate limits, JWT validation and permission checks.
Active
Layer 03
PostgreSQLRow-level security contracts and tenant-scoped persistence.
Active
Layer 04
IntegrationsStripe, Companies House and HMRC gated until credentialed.
Gated

Actively maintained infrastructure

Runtime, dependencies, secrets and hosting images are kept current. We do not claim certifications we have not earned — but we build as if an auditor is watching.

Your clients' data deserves better than spreadsheets

See how Taxcc handles tenant isolation, portal access and audit trails in a live trial.

Start free trialExplore features