Security

Who runs Octotax

Octotax is run by Jacob Norton, a sole trader trading as Octotax, in the United Kingdom. It's at an early stage and being used by a small number of firms. Being small means very few people can reach your data. It also means there's no round-the-clock security team yet, so we've kept the design simple and the claims on this page modest.

What's in place today

• Hosted in the UK

  The service and its database run on equipment Octotax operates in the United Kingdom.

• Network protection

  Traffic to Octotax passes through Cloudflare, which filters out attacks and abusive traffic before it reaches our equipment.

• Encrypted in transit

  Every connection to the app and the client portal uses HTTPS (TLS).

• Sensitive fields encrypted at rest

  National Insurance numbers, dates of birth, Companies House authentication and personal codes, AML risk assessment answers, Self Assessment questionnaire answers and saved passwords (shared resources and your mail server password) are encrypted in the database with authenticated encryption.

• Documents encrypted at rest

  Files uploaded by your firm and by your clients are encrypted when stored. The only exception is the logo you upload for white-label branding, which is public.

• Encrypted off-site backups

  The database is backed up every night and backups are kept for 30 days. Each backup is encrypted on our equipment before it's copied to Google Drive, so Google can't read it.

• Each firm's data kept separate

  Every record belongs to one firm, and every request is limited to the signed-in firm's data.

• Role-based access

  Owners, staff and clients have different access. Owners choose which modules staff can use, and WIP and billing figures are owner-only unless an owner allows them. Clients see only their own client area, and firms see nothing from a client's Octotax app unless the client chooses to share it.

• Sign-in protection

  Passwords are stored only as salted hashes. Emailed sign-in codes work once and expire after 15 minutes. Sign-in attempts are rate-limited. Invitation links, one-time links and portal sessions are stored only as one-way hashes.

• Two-factor sign-in

  Owners and staff can protect their sign-in with an authenticator app code and recovery codes. Owners can require it across the firm, and it's required for Octotax administrators. Staff can sign out of every other device from Your account.

• Full export and account closure

  Owners can download a full export of the firm's data (clients, documents and history) at any time, and close the account. Data is deleted 30 days after closure, and drops out of backups within a further 30 days.

• Audit log

  Changes to client records and actions in the client portal are recorded with who did what and when, on each client's Audit log tab.

• Limited access at Octotax

  Only the operator, Jacob Norton, has administrative access to the servers, database and backups.

What isn't done yet

• Encrypting tax references

  Unique Taxpayer References are used to search for clients, so they're not yet encrypted at rest. We're adding a search method that works without storing them in readable form, then encrypting them.

• Independent certification

  We don't hold an independent security certification yet. We plan to get one as Octotax grows, and we'll say so here when we do.

Who else handles data

A short list of companies help us run the service, such as Cloudflare for network security and Resend for email. The full list, with what each one handles and where, is on our sub-processors page. We don't sell data, and there are no advertising or analytics trackers in the app or the client area. The one exception to “no tracking” is Self Assessment questionnaire emails, which record when they're opened or their link is clicked, so the firm can see whether a client has seen them.

For firms

• Your firm controls its clients' data, and we process it on your behalf under our data processing agreement.
• Give each person their own sign-in, and deactivate staff who leave (Team, then Deactivate).
• Use Settings, then Staff permissions, to switch off modules staff don't need.
• Check a client's Audit log tab to see who changed what.
• If we ever have a breach that affects your firm's data, we'll tell your practice owner without undue delay, and in any case within 48 hours of becoming aware of it, and help you meet your own obligations.

For clients of a firm using Octotax

If your accountant has invited you to a client area that runs on Octotax, your accountant is in charge of your data and decides how it's used. We store and protect it for them. You sign in with a one-time code sent to the email address your accountant has on file, and documents you upload are encrypted when stored. To see, correct or delete your data, contact your accountant first. If you think something is wrong with the client area itself, you can also email us at [email protected].

If you link the free Octotax app to your accountant, you choose what they can see from it, and you can unlink at any time. Our privacy notice for firms and their clients explains how that works.

Reporting a security problem

If you think you've found a security weakness, email [email protected] with “Security” in the subject. Tell us what you found and how to reproduce it. We aim to reply within one working day, and we'll keep you updated until it's fixed.

Safe harbour for security research

If you look for and report a weakness in good faith and follow these rules, we won't take legal action against you or report you to the authorities for that research:

• Only test against your own account, or a trial practice you've created yourself.
• Don't access, change, copy or delete other people's data. If you come across some by accident, stop, don't keep it, and tell us.
• Don't degrade the service for others: no denial of service, spam or high-volume automated scanning.
• No social engineering, phishing or physical attacks, and don't test our providers (such as Cloudflare or Google) directly.
• Give us a reasonable chance to fix the problem, normally 90 days, before telling anyone else.

We can't pay rewards at this stage, but we'll thank you publicly if you'd like. This promise covers us only; it can't bind anyone else.