Trust and security
Last updated: 18 October 2026. This page describes what is in place today. Where something is still being confirmed, we say so.
How we protect your data
- Each business sees only its own data. Access is separated per business and checked on every request, and this is tested automatically.
- Two-step verification. Every user can turn it on, and it is always asked for before sensitive actions such as filing to HMRC or connecting a bank.
- Team permissions. Team members get only the access they are given, for example payroll or payments.
- Activity log. Sensitive actions are recorded with who did them, and the business owner can download the log.
- Encryption. Data is encrypted in transit, and connection credentials are encrypted at rest.
- Checks before every change. Every change to the software is tested before it goes live.
- Your data, your control. Each business can see how long records are kept, and can find, export, correct and delete personal data when someone asks.
- Incidents. We have an incident response plan and report personal data breaches to the Information Commissioner's Office as the law requires.
Certifications
We are registered with the Information Commissioner's Office (ICO). Cyber Essentials is in preparation; we will show it here once the certificate is awarded.
Services that process data for us
We use carefully chosen providers for hosting, email, payments and reading documents with AI, each under a data processing agreement. Some data may be processed outside the UK under the UK's approved safeguards. Business customers can ask for the list of providers under their data processing agreement by emailing contact@taxbix.com.
On our public website only, and only if you agree to cookies, analytics and advertising partners receive data about your visit. See cookies in our privacy policy.
Report a security issue
If you think you have found a security weakness in Taxbix, or that your account or data has been compromised, please email contact@taxbix.com with "Security issue" in the subject. Please include what you found, where, and the steps to see it. We treat every report urgently.
When you look into an issue, please use only your own account and data, do not view, change or delete other people's data, and do not run tests that could slow down or interrupt the service.