Security

How to report something

Email azhar@makingtaxeazy.co.uk. It reaches a person, not a queue.

Please include, as far as you can:

• what you found, and how to reproduce it;
• which page or address it affects;
• whether you believe any personal or financial data was exposed, and roughly how much;
• how we can reach you if we need to ask something.

If the report itself contains sensitive detail, say so in the first line and we will arrange a secure way to receive the rest.

What we will do

• Acknowledge within one working day that a person has read it.
• Assess it within three working days and tell you whether we have reproduced it and what we intend to do.
• Keep you informed until it is closed, and tell you when it is fixed.

Where a report concerns personal data, we notify the Information Commissioner’s Office within 72 hours of becoming aware, and we tell the people affected where the law requires it. Where it concerns data connected to HMRC’s systems, we notify HMRC within 72 hours through their Developer Hub with a named contact.

If you are testing our security

We do not run a paid bug bounty, and we are a small company — but we will not threaten you for telling us about a genuine problem found in good faith.

Please do:

• use your own account and your own test data;
• stop as soon as you have shown a problem exists;
• give us reasonable time to fix it before telling anyone else.

Please do not:

• access, modify or keep anybody else’s data — if you reach data that is not yours, stop and tell us what you saw rather than how much you could see;
• run denial-of-service tests, send bulk automated traffic, or anything that degrades the service for real users;
• test HMRC’s systems. They are not ours, and their rules are their own.

What we do at our end

Two-step verification is required on every account. HMRC access tokens are encrypted before storage. Uploaded documents are held in private storage that is not publicly addressable. Traffic is encrypted in transit, and our calls to HMRC leave from a single declared address.

We do not store your HMRC sign-in details. Authentication with HMRC happens directly between you and them, and we never see those credentials.

The product is in active development and we do not claim it is beyond compromise. That is the reason this page exists.