Security at Suma

• All data travels over encrypted connections (TLS); the app refuses non-HTTPS connections by design.
• Sensitive data is encrypted at rest with AES-256-GCM, including HMRC access tokens and National Insurance numbers. Encryption keys are stored separately from the database.
• Your data is isolated per account: every record is tied to your user ID and enforced with database row-level security, so no account can read another's data.
• We never see or store your Government Gateway credentials. Connecting to HMRC happens on HMRC's own website via OAuth; we only receive a token, which is stored encrypted.
• Application logs and error reports automatically strip tokens, National Insurance numbers and other identifiers.
• Every submission to HMRC is recorded in an audit trail, and all traffic is rate-limited to protect against abuse.

If you believe you've found a vulnerability or security concern, email support@sumatax.co.uk with "Security" in the subject line. We'll acknowledge your report promptly and keep you informed as we investigate. Please don't access data that isn't yours or disclose the issue publicly before we've had a reasonable opportunity to fix it.

If a breach occurs that puts your data at risk, we will notify the ICO within 72 hours and inform affected users, as set out in our Privacy Policy.