HMRC Compliance Center

Making Tax Digital (MTD) for VAT is HMRC’s requirement that VAT-registered businesses keep their VAT records digitally and file VAT returns through software that connects to HMRC directly. Typing figures into HMRC’s online VAT form, or emailing a spreadsheet to your accountant to key in, is no longer the compliant route.

In practice MTD asks three things of you:

• Keep your sales and purchase records in digital form.
• Preserve those records for the statutory retention period.
• Submit the nine-box VAT return through HMRC-compatible software using a digital link.

ProPortalBusiness is built around that flow: your invoices and expenses are already digital records, and the return is sent over HMRC’s MTD VAT API from inside the app.

• Digital record keeping. Invoices, expenses and scanned receipts are captured once and stored against your business — no re-entry at quarter end.
• Direct HMRC authorisation. You authorise us through HMRC’s own OAuth sign-in; we never see or store your Government Gateway password.
• Obligation sync. Your open VAT periods and due dates are pulled from HMRC so you file against the right period.
• Nine-box preparation. Boxes are pre-filled from your records, with Box 3 and Box 5 calculated for you and rounding handled to HMRC’s rules.
• Fraud prevention headers. HMRC requires software to send prescribed fraud prevention headers with every API call; we send them on your behalf.
• Append-only audit trail. Every connection, sync and submission is logged and cannot be edited after the fact.

To support MTD filing we hold the following, scoped to your business only:

• VAT profile. Your VAT registration number, VAT scheme, flat-rate percentage where applicable, and return frequency.
• HMRC connection. The access and refresh tokens issued by HMRC when you authorise us, plus the environment and expiry. Tokens are encrypted at rest with AES-256-GCM and are only decrypted server-side when a call to HMRC is made.
• VAT obligations. Period keys, start and end dates, due dates and status returned by HMRC.
• VAT returns. The nine box values you submitted, the period they relate to, the declaration you agreed to, and HMRC’s response including processing date and reference.
• Audit log. An append-only record of MTD actions with timestamps and the acting user.
• Underlying business records. The invoices, expenses and receipts the figures are drawn from.

We do not store your Government Gateway username or password, and we do not use your VAT data for anything other than operating the service for you. Access is enforced per-business at the database level, so no other customer can read your records. See the Security & Compliance page for the full control set.

1. 1

   Set your VAT profile

   In Making Tax Digital → VAT settings, enter your VAT registration number (VRN), your VAT scheme (standard or flat rate) and your return frequency. This is what we use to identify you to HMRC.

2. 2

   Connect your HMRC account

   On the Connection tab, choose “Connect HMRC account”. You are taken to HMRC’s own sign-in page, log in with your Government Gateway credentials and grant VAT access. You never enter your Government Gateway details into ProPortalBusiness.

3. 3

   Keep digital records as you work

   Raise invoices and record expenses (including scanned receipts) in the platform throughout the quarter. Those records are your digital VAT records — MTD requires them to be kept digitally rather than re-typed from paper at quarter end.

4. 4

   Sync your obligations

   On the Obligations tab, sync from HMRC to pull your open VAT periods, their start and end dates, and the due date for each. Choose the period you want to file.

5. 5

   Review the nine boxes

   The Submit return tab pre-fills the nine boxes from your invoices and expenses for that period. Boxes 3 and 5 are calculated automatically. Check every figure against your own records and adjust where you have transactions kept outside the platform.

6. 6

   Declare and submit

   Tick the legal declaration confirming the information is true and complete, then submit. The return goes directly to HMRC’s MTD API — there is no spreadsheet upload and no manual re-keying into the HMRC portal.

7. 7

   Keep the receipt

   We store HMRC’s response, including the processing date and form bundle/charge reference, against the return. You can see submitted returns and the append-only audit trail at any time, plus your liabilities and payments pulled back from HMRC.

Most VAT-registered freelancers file quarterly. HMRC’s standard deadline is one calendar month and seven days after the end of the VAT period, and payment is due by the same date. Your exact due dates are shown on the Obligations tab, taken from HMRC rather than assumed by us.

VAT records must be preserved for at least six years. We retain your invoices, expenses, submitted returns and audit trail for as long as your account is active, and our deletion process is described in the Security & Compliance page — export your records before requesting erasure so you keep the evidence HMRC may ask for.

• Data is encrypted in transit with TLS and at rest by our infrastructure providers.
• HMRC tokens are additionally encrypted with AES-256-GCM before being stored.
• Per-business isolation is enforced with database row-level security policies.
• Optional multi-factor authentication (TOTP) protects your login.
• VAT submissions write to an append-only audit log that cannot be edited or deleted in the app.

This page explains how our software works and is general information, not tax advice. For your specific circumstances, check GOV.UK guidance or speak to a qualified accountant.