Security & Compliance

The platform is delivered as a managed, cloud-hosted service. The application layer runs on a globally distributed edge network, and application data is stored in a managed PostgreSQL environment operated by our infrastructure providers within their enterprise data centres.

We do not operate our own physical servers. Physical security, environmental controls and hardware lifecycle management are the responsibility of our underlying infrastructure providers, who operate dedicated facilities with restricted physical access, continuous monitoring and redundant power and cooling.

Environments are logically separated. Preview and production workloads run against separate application deployments, and administrative credentials are held only in managed secret storage rather than in application source code.

In transit. All traffic to and from the platform is served exclusively over HTTPS using TLS. Requests received over plain HTTP are redirected to the encrypted endpoint, and all first-party API calls, webhooks and file uploads use the same encrypted channels.

At rest. Database storage, file storage and backups are encrypted at rest by our infrastructure providers using industry-standard disk-level encryption.

Application-level encryption. Highly sensitive integration credentials — including bank connection tokens and HMRC access and refresh tokens — are additionally encrypted at the application layer using AES-256-GCM before they are written to the database, with keys held in managed secret storage separate from the data. Multi-factor authentication secrets and backup codes are stored in a protected form and are never displayed again after initial enrolment.

Card details are never transmitted to or stored on our systems. Payment credentials are captured and held directly by Stripe.

Tenant isolation. Every business record is bound to an owning account and protected by row-level security policies enforced in the database itself, not merely in application code. A request authenticated as one account cannot read or modify another account's clients, invoices, receipts, contracts, projects or tax records, even if the request is crafted manually against our endpoints.

Authentication. Accounts are secured with email-and-password or federated Google sign-in. Time-based one-time password (TOTP) multi-factor authentication is available to all users, with single-use backup codes and an optional trusted-device policy. Email addresses are verified, and password resets are performed through expiring, single-use links.

Authorisation. Roles and entitlements are stored server-side in a dedicated privileges table and evaluated by security-definer database functions. Client-side state is never trusted to determine privilege. Plan-level feature access is enforced by server-side guards in addition to interface restrictions, and staff or accountant access is granted explicitly and can be revoked at any time by the account owner.

Least privilege. Elevated, RLS-bypassing database credentials are used only for narrowly scoped administrative operations executed on the server, and are never exposed to the browser.

Client portals. Your clients access their portal through scoped, revocable links that expose only the records you have shared with them, without granting access to your wider account.

We retain your business records for as long as your account remains active, because they form your operating and financial history. Records you delete inside the application — such as a client, invoice or receipt — are removed from your active workspace immediately.

You can export a complete machine-readable copy of the data we hold for you at any time, and you can request erasure of your account directly from your settings. An erasure request removes your profile, clients, invoices, receipts, uploaded receipt files, subscription records, role assignments and authentication identity.

Where UK law requires retention of accounting and tax information for a statutory minimum period, you remain responsible for keeping your own exported copies. We recommend generating an export before requesting erasure. Encrypted infrastructure backups are retained on a rolling short-term schedule by our providers and then expire automatically.

Records required for security, fraud prevention or the resolution of a payment dispute may be retained for the period necessary to meet that obligation, and are then deleted or irreversibly aggregated.

Sensitive financial actions are recorded in an append-only audit trail. Entries cannot be edited or deleted from the application, which preserves the integrity of the record for review by you, your accountant or a tax authority.

Making Tax Digital activity is captured in dedicated audit records covering HMRC connection and disconnection events, VAT obligation synchronisation, draft return calculations, and the formal declaration and submission of a VAT return — including the period, the figures submitted and the receipt returned by HMRC. Submitted periods are locked against further amendment.

Authentication events, multi-factor enrolment and trusted-device registration are logged, as are privileged administrative operations and inbound payment webhooks. Application and infrastructure logs are retained for a limited operational window for security monitoring and incident investigation, and are access-restricted.

Subscription billing and client invoice collection are processed by Stripe. Stripe is a PCI DSS Level 1 certified payment provider; card data is entered into Stripe-hosted fields and tokenised, so no card number ever reaches our infrastructure. We store only non-sensitive references such as customer, subscription and session identifiers.

Inbound payment webhooks are signature-verified before any record is created or updated, preventing forged payment notifications from altering your revenue data.

Where you connect a bank account, the connection is established through a regulated open-banking provider. We receive read-only transaction and balance information for reconciliation; we never receive your online banking credentials and cannot initiate payments from your account.

The platform runs on managed, horizontally scaled infrastructure with automated failover at the provider level. Database backups are taken automatically by our infrastructure provider and stored encrypted, enabling point-in-time recovery within the provider's retention window.

Application releases are deployed through an automated pipeline with type checking and an automated test suite covering entitlement and access-control behaviour, so that authorisation regressions are caught before release. Dependencies are monitored for published vulnerabilities and patched on a prioritised basis according to severity.

We welcome responsible disclosure. If you believe you have identified a security vulnerability in ProPortalBusiness, please contact us at security@proportalbusiness.com with sufficient detail to reproduce the issue.

Please do not access, modify or delete data belonging to other users, degrade the service, or publicly disclose the issue before we have had a reasonable opportunity to remediate it. We will acknowledge legitimate reports, keep you informed of progress, and confirm when a fix has been released.

For questions about data protection, see our Privacy Policy and Terms of Service.