Security
Your tax record is the most private thing most people own. This page says how access to it works, what protects a sign-in, who processes what and where, and — at the end — what we do not claim.
Who can reach a record
A record is reached through a session, never an address
Every read and every write resolves whose record it is from the signed-in session. Naming somebody else's address in a request does not reach their record, and the refusal is the same whether the address exists or not — so a refusal cannot be used to find out who has an account.
A practice sees a client only through that client's grant
An accountant cannot add a client and cannot ask for access. The person whose record it is adds the practice from their own overview and withdraws it in one click, which takes effect on the practice's very next request. The grant is re-read on every request rather than trusted from a session.
Inside a practice, roles are separate
A firm's members each have their own login, and what they may do is a table rather than a rank: opening a client's identity documents, raising a fee, lodging a payroll submission to Revenue and adding people are separate permissions. A read-only login opens the records and changes nothing.
What was done is recorded against a person
Entries a practice makes on a client's books carry the person and the firm, and the client can read that beside the row on their own screen. Journals and adjustments keep their history when deleted, and the verifier's decisions are append-only.
Signing in, and holding a session
- Passwords are stored as scrypt hashes, never in a form anybody can read back.
- A second factor can be enrolled on every audience — a person's own account, a practice login and an administrator — with recovery codes kept as hashes.
- Signing out ends the session on every device of the account, server-side, rather than clearing a cookie in one browser.
- A password reset ends every session issued before it.
- Sign-in attempts, password resets, filing routes and the public write routes are rate limited, counted in one window shared across server instances rather than per instance.
- Uploads are checked by type and size, their names reduced to a bounded label, and never used as a path.
In transit and in the browser
- HTTP Strict Transport Security, with preload, on every response.
- A content security policy: a static one on the public site, and on the three consoles a policy whose script nonce is minted per request.
- Framing denied outright, and a referrer policy that does not leak a path to another origin.
What is kept, and how it is kept honest
Evidence keeps its fingerprint
A document uploaded to a record — a receipt, a supplier's invoice, a bank statement — carries the SHA-256 of its bytes, computed on the server, and each time its original is opened, who opened it is logged. A document attached to a case carries its SHA-256; opening it is not logged yet.
Figures are reconciled, not absorbed
An import is proved against the file it came from, and a difference is shown rather than quietly written off. The same rule runs through the bank reconciliation and the migration's opening entries.
Backups and the six-year archive
The runbook sets out the restore drill and the six-year archive the tax obligation runs to, because a backup window of weeks does not answer a question asked in year five. Point-in-time recovery is not claimed here until the restore has been rehearsed and dated in that runbook.
Erasure
A person can ask for erasure from their own Security screen. What must be kept by law is named in the answer rather than quietly kept, and the procedure is written down. The deletion half has been carried out; the six-year archive half has not yet been rehearsed.
Who processes your data, and where
Read from this deployment’s own configuration, so a service that is not switched on is not listed as though it were. Sign-in for customers and practices is ours; administrator sign-in uses Firebase Authentication, which processes in the United States.
- Vercel
- Runs the application and serves every page. Sees requests as they are made, including IP addresses in its operational logs. Location: European region, where the project is configured for one.
- Google Firebase — Firestore and Storage
- Holds the records: accounts, books, tax years, and the documents uploaded as evidence. This is where the data lives when nobody is looking at it. Your sign-in does not use Firebase Authentication: your password is hashed by this application and kept with the records. Firebase Authentication is used only for our own administrators' sign-in, and Google processes that in the United States. Location: europe-west1
- Google Ireland Limited — Google Analytics 4
- Counts which public pages are read, so we can see what is useful. Only on the public pages, never inside an account, the practice console or the admin area, and only after you click Accept on the cookie banner; until then nothing is loaded from Google. Advertising features and Google signals are off. Location: Google Ireland Limited in the European Union; Google may process in the United States under its own data processing terms and the EU-U.S. Data Privacy Framework.
- Resend (Plus Five Five, Inc.)
- Delivers the messages the product sends: address confirmation and password reset links, practice invitations, the confirmation of a subscription on a durable medium and notices about it, and — where you send them from the product — invoices, reminders, statements and payslips to the people you address them to. Location: United States — Resend keeps account data, logs and message metadata there whichever region a message is sent from, under the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses in Resend's data processing addendum.
- Stripe
- Takes the payment and runs the subscription. Checkout, changing a card, invoices and cancelling happen on Stripe's own pages, so card details are given to Stripe and never reach this application — there is no card field anywhere in it. The application holds a Stripe key, which it uses to start those pages and to read back whether a subscription is paid, and Stripe tells it when that changes. Location: European Union and the United States, under Stripe's own terms.
The privacy notice says what each of them receives and why.
What we do not claim
- We do not hold SOC 2, ISO 27001 or any other security certification, and nothing on this site is Revenue-approved or endorsed by any authority.
- We are not a bank and hold no client money.
- No third party has audited this product's security. What is written above describes the code as built and tested; it is not an attestation by anybody else.
Reporting a problem
If you find a weakness, write to office@managetax.ie with enough detail to reproduce it. Please do not test against anybody else’s record. We will answer, and we will tell you what we changed.
See also the accessibility statement and the guide to your data.