Security and reporting a problem

Last updated 3 November 2026. If you have found a security problem with MTD Software, or think your account or data may have been exposed, please tell us straight away.

How to report

Email contact@mtd-software.co.uk with the subject “Security report”. Tell us what you found, the page or feature involved and how to reproduce it. Please do not include other people’s personal data, and please do not access or change anyone else’s account while testing. We will acknowledge your report and keep you updated on what we do.

What we do when something is reported

We investigate promptly, fix confirmed problems, and tell affected customers. If personal data is affected we will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it where the law requires, and, where HMRC submission is available, we will tell HMRC immediately about any issue affecting customer data connected with HMRC.

How we protect your information

• Your bank entries are processed in your browser and are not sent to or stored on our servers.
• Accounts use email and password sign-in through our authentication provider, Supabase. Passwords are stored only in hashed form.
• Access to account data is restricted so that one customer cannot see another customer’s data.
• Card payments are handled by Stripe. We never see or store your card number.
• All connections to the site use HTTPS.

See our privacy policy for what we collect and your rights.