Bank-Grade Security
Your financial data deserves bank-grade protection.
Here's exactly how we deliver it.
✅Direct to HMRC
🛡️ICO Registered
🇪🇺EU Data Centres Only
🔐
Encryption
✓AES-256 encryption for all data at rest
✓TLS 1.3 for all data in transit
✓Sensitive fields (NI numbers, bank details) protected with separate key management
✓Every organisation’s data is logically isolated — one customer can never access another’s.
🏗️
Infrastructure
✓EU data centres — your data never leaves Europe
✓Enterprise-grade database with automated daily backups and point-in-time recovery
✓DDoS protection and rate limiting on all endpoints
✓Real-time monitoring and alerting across all services
🔑
Authentication
✓Enterprise-grade identity management
✓Multi-factor authentication available on all accounts
✓Short-lived, automatically-rotated access tokens; sign out remotely at any time
✓OAuth 2.0 for HMRC — we never see or store your HMRC password
🏦
Your bank data
✓You import a statement you exported yourself — Accounted holds no connection to your bank account
✓We never ask for, and never store, your banking login
✓Because there is no standing connection, there is nothing for us to lose and nothing to revoke
✓No card numbers or bank credentials stored on our servers
🤖
AI & Data Processing
✓AI built with privacy and safety as core principles
✓Transaction data used for categorisation only, never for training
✓No financial data is used to train AI models
✓All AI processing is GDPR compliant
📋
Compliance
✓ICO registered
✓Fully GDPR compliant — data subject rights honoured within 30 days
✓Making Tax Digital software that files directly to HMRC
✓Regular security audits and penetration testing
✓Vulnerability disclosure: hello@getaccounted.co.uk
Incident Response
24/7
Real-time error monitoring and alerting across all services
72hrs
Maximum time to notify affected users of a security incident
100%
HMRC and ICO notified where required under GDPR and HMRC guidelines
Messaging Security
Penny communicates via Telegram and web chat for convenience — receipt uploads, reminders, and quick actions. Sensitive operations like HMRC submissions, bank connections, and payment details always happen inside your encrypted dashboard behind two-factor authentication. Penny will never ask for your password, bank details, or full National Insurance number via messaging.
🔍
Responsible Disclosure
Found a vulnerability? We want to hear from you. We believe in working with security researchers to keep Accounted safe for everyone.
✓Email your findings to hello@getaccounted.co.uk
✓We acknowledge all reports within 48 hours
✓We will not take legal action against good-faith security researchers
✓Please give us reasonable time to fix issues before public disclosure
Security is not a feature — it's the foundation.
If you have any security concerns, contact hello@getaccounted.co.uk
Last updated: March 2026