Security

This page summarises the technical and organisational measures TinyTax Ltd uses to protect customer data on the TinyTax service. Definitive terms are in our Terms of Service and Data Processing Agreement; the Sub-processor List identifies the third parties that handle data on our behalf.

Hosting and data residency

• Production hosting: Hetzner Online GmbH at Falkenstein, Germany. Transfers to Germany rely on the UK adequacy regulations covering EEA countries.
• Off-site backups: encrypted database snapshots replicated to DreamHost (United States) under the UK International Data Transfer Agreement.
• Staging environment: OVHcloud at Gravelines, France. Staging holds sandboxed test data by default; production data is loaded only when explicitly seeded for support investigation, and is deleted after use.

Encryption

• In transit: all customer-facing endpoints require TLS 1.2 or higher. HSTS is enforced on production domains.
• Backups: database backups are transmitted over SSH to off-site storage and protected at rest by the storage provider's access controls.
• Application secrets and stored credentials (such as OAuth tokens) are encrypted with AES-256 using keys held outside the database.

Access control

• Production server access is restricted to a small number of named operators with key-based SSH and a per-host audit trail.
• Database access from the application is least-privilege scoped per credential type.
• Internal admin tooling sits behind authentication and authorisation checks distinct from the customer login flow.
• Customer authentication uses bcrypt password hashing and CSRF protection on every state-changing action.

Monitoring and resilience

• Production logs are retained for 90 days for security monitoring and operational diagnostics.
• Automated alerting on application errors and slow queries.
• Database backups taken daily with off-site retention; recovery exercises performed periodically.

Submissions to HMRC and Companies House

• All submissions are made over TLS using the providers' published APIs.
• Government Gateway credentials supplied for a submission are used for that submission only and are not retained beyond it.
• The submitted XML envelope is retained as the audit record of what was filed (see Privacy Policy §2.4 for retention periods).

Vulnerability disclosure

If you believe you have found a security vulnerability, please email with the details. Please give us a reasonable opportunity to investigate and fix the issue before any public disclosure. We do not currently operate a paid bug bounty programme.

What we don't claim

We do not currently hold ISO 27001 or SOC 2 certification. The trust documentation on this site (Terms, Privacy, DPA, Sub-processor list, this page) is the published basis on which we sell the service. If your procurement process requires a certified provider, we may not be the right fit at this stage.