Security

If you think you’ve found a vulnerability in Smart Tax Digital, or that data held by us has been exposed or misused, email security@smarttaxdigital.com. Customers, security researchers and anyone else can use this address.

To help us act quickly, include as much as you can:

• what you found and where (the page or address involved)
• steps to reproduce it, or when and how you noticed it
• what you think the impact is
• how we can contact you

Please don’t include passwords, your full National Insurance number or other sensitive details in the email — we’ll ask for anything we need in a safer way.

• We’ll acknowledge your report within 2 working days.
• We’ll investigate, and keep you updated at least every 10 working days until it’s resolved.
• If personal data has been affected, we’ll notify the Information Commissioner’s Office and HMRC within 72 hours where the law requires it, and tell affected customers without undue delay if they’re at high risk.
• With your permission, we’re happy to credit you once the issue is fixed.

We won’t take legal action against anyone who reports a vulnerability to us in good faith and follows these guidelines:

• Only test against your own account. Never access, change or delete anyone else’s data — if you come across it, stop and tell us.
• Don’t run denial-of-service tests, automated scans that degrade the service, spam or social-engineering attacks on our staff or customers.
• Don’t send test submissions to HMRC in anyone else’s name.
• Give us reasonable time to fix the issue before telling anyone else about it.

• Reset your password from the forgot password page.
• Remove this app’s access in your HMRC online account if you think someone else may have used it. You can reconnect afterwards.
• Email security@smarttaxdigital.com so we can check your account’s activity and sign out every session on it.

We will never ask for your Government Gateway password, and HMRC sign-in only ever happens on HMRC’s own website. If you receive a message claiming to be from Smart Tax Digital that asks for passwords or payment details, forward it to security@smarttaxdigital.com.

Suspicious messages claiming to be from HMRC should be reported to HMRC — see how on GOV.UK.

• HMRC access tokens are encrypted with AES-256-GCM before storage, and we never store your Government Gateway credentials.
• All traffic is encrypted in transit (TLS), and a strict Content Security Policy limits what can run on our pages.
• Our database is only reachable from our servers — never directly from a browser.
• Sign-in sessions can be revoked instantly, staff access is role-based, and staff actions are audit-logged.
• Accountants you invite can never connect to HMRC or submit anything on your behalf.
• We send HMRC the fraud prevention data it requires with every request, to help protect your identity.

Our Privacy Policy explains what data we hold and why.