Does Making Tax Digital connect directly to HMRC, or do I still need to file manually?

Your HMRC connection is authorised through HMRC's own website using their official OAuth2 flow — your HMRC password is never shared with us. Once authorised, we hold a secure, encrypted credential that lets us submit your quarterly MTD ITSA updates directly to HMRC on your behalf. You can revoke that access at any time via Manage Authorised Applications on the HMRC website.

My transactions come from my letting agent's software. Do I have to re-enter them here?

No. The platform connects to AgentOS-powered letting agent software and pulls your income and expense transactions automatically. Each sync imports rent received, maintenance deductions, management fees, and other line items directly into your transaction ledger, where they are mapped to the correct HMRC property income categories. You review, adjust where needed, and submit — no manual re-keying.

How does the quarterly submission process actually work, step by step?

After your letting agent transactions are imported, you categorise any that need attention, then hit Compute for the relevant quarter. The platform aggregates your income and expenses into the figures HMRC requires. Once you are happy with the totals, you click Submit to HMRC. The submission runs in the background, and you receive an in-app notification confirming acceptance or flagging any rejection with a plain-English explanation of what to fix.

Is my National Insurance Number and financial data stored securely?

Yes. Your National Insurance Number is encrypted at rest using AES-256-GCM before it is stored, and it is never written to application logs or exposed in URLs. HMRC OAuth tokens and bank connection credentials receive the same encryption treatment. The platform uses separate encryption keys per data classification — HMRC tokens, NINOs, and bank credentials each have their own key — so a compromise of one key does not expose everything else.

Can I also connect my bank account, or is the letting agent the only data source?

You can connect a bank account via Open Banking in addition to your letting agent software. Bank transactions are optional and must be explicitly included by you — they do not flow into your tax ledger automatically. This gives you control over which bank entries supplement your letting agent data, and prevents accidental double-counting of transactions that already appear from your agent.

What happens if I miss a quarterly deadline or my HMRC connection expires?

The platform monitors your submission deadlines and sends tiered reminders at 30 days, 7 days, and 1 day before each quarter is due. If your HMRC authorisation is approaching expiry, you receive warnings at 30 days and 7 days in advance so you can re-authorise before it lapses. If a submission fails, you receive an immediate notification explaining the HMRC error code in plain English along with the steps to resolve it.

SECURITY & PRIVACY

Your tax data deserves more than a padlock icon

We handle National Insurance Numbers, HMRC OAuth tokens, and quarterly tax submissions. Here is precisely what we do — and do not do — to protect that data.

AES-256-GCM encryption at rest

HMRC OAuth tokens, your National Insurance Number, and bank OAuth credentials are each encrypted with domain-isolated keys before they touch the database. Separate keys limit blast radius if any one key is ever compromised.

HMRC OAuth — your password never leaves HMRC

We connect to HMRC via the official OAuth 2.0 authorisation flow. You log in on HMRC's own website. We receive a scoped access token — never your Government Gateway password — and you can revoke access at any time via HMRC's Manage Authorised Applications.

Encrypted credential storage throughout

HMRC tokens, bank tokens, NINOs, and organisation database connection strings are all stored encrypted. The schema enforces this with explicit column naming conventions so plaintext storage is structurally blocked for sensitive fields.

AUTH CONTROLS

Multi-factor authentication built in

TOTP-based MFA (authenticator app) is available on every account. Once enabled, your 6-digit code is required alongside your password. Sessions are time-limited and sign-out is enforced server-side.

TOTP authenticator app support
Backup codes for account recovery
Role-based access: owner, admin, member
Email verification required before dashboard access

DATA ARCHITECTURE

What we store, what we encrypt, what we never touch

National Insurance Number

Stored with AES-256-GCM encryption under a dedicated NINO_ENCRYPTION_KEY, isolated from HMRC token encryption. Never logged, never in URLs, never transmitted in plaintext.

Audit log showing every transaction change with timestamps

AUDIT & ACCOUNTABILITY

Every change is logged. Every submission is traceable.

The audit log records every transaction categorisation, exclusion, edit, and HMRC submission with the user, timestamp, and IP address. If a question ever arises about what was submitted to HMRC and why, you have a clear, timestamped record.

INFRASTRUCTURE

Built on verified infrastructure, not roll-your-own

Content Security Policy

CSP headers restrict which scripts, frames, and connections the application can make — limiting the impact of any injected content. X-Frame-Options, X-Content-Type-Options, and Strict-Transport-Security are all enforced.

Rate limiting on sensitive endpoints

HMRC OAuth initiation, authentication endpoints, and feedback routes are rate-limited. Distributed rate limiting prevents credential stuffing even across serverless instances.

OPEN BANKING

Bank connections are read-only and consent-bound

Open Banking access via TrueLayer is read-only — we can see your transactions, but we cannot move money. Consent has a defined expiry date. You receive reminders at 30, 7, and 1 day before expiry, and you can disconnect at any time from within the app.

Read-only access — no payment initiation
Consent expiry tracked and enforced automatically
Bank OAuth tokens encrypted under a separate key
Disconnect at any time from Bank Accounts settings

UK GDPR

Your rights under UK data protection law

Right of access

You can request a copy of all personal data we hold — your profile, NINO (masked), properties, transactions, and submissions — at any time.

Right to rectification

Update your name, National Insurance Number, and contact details directly in Settings. Profile data is under your control without raising a support request.

Security questions, answered plainly

Ready to file with confidence?

Connect your letting agent, categorise your transactions, and submit your quarterly HMRC return — knowing your credentials and financial data are protected at every step.

Questions? Email sf-core-org-support-making-tax-digital@saas-factory.ai