Security & Compliance

VATBuild holds Cyber Essentials certification, awarded by the IASME Consortium on behalf of the National Cyber Security Centre (NCSC). Cyber Essentials is the UK Government-backed scheme that demonstrates a baseline of cyber security controls is in place.

Cyber Essentials covers five technical controls: boundary firewalls & internet gateways, secure configuration, access control, malware protection, and patch management.

VATBuild is registered as a Data Controller with the Information Commissioner's Office (ICO), the UK's independent authority for data protection. All personal data is processed in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For questions about how we handle your personal data, see our Privacy Policy or contact privacy@vatbuild.co.uk.

Account security at VATBuild is built around multiple independent layers, not a single password gate.

• Multi-factor authentication (MFA): all accounts support time-based one-time passwords (TOTP) via any standard authenticator app.
• Email OTP fallback: a one-time code sent to your registered email address is available as a secondary factor when TOTP is not configured.
• Brute-force protection: both per-IP and per-account lockouts are in place to prevent credential-stuffing attacks. Accounts are automatically unlocked after a cooldown period.
• Password hashing: passwords are hashed with scrypt (Node.js built-in, 64-byte output) and never stored in plain text.
• Session management: sessions are signed and HTTP-only. CSRF protection is applied to all state-changing API endpoints.
• API key security: API keys are issued as opaque tokens; only a SHA-256 hash is stored server-side. Keys can be revoked instantly from Account Settings.

VATBuild is hosted on dedicated production infrastructure, deployed as a long-running VM (not a scale-to-zero function), with the controls described below.

• Encryption in transit: all traffic is served exclusively over TLS 1.2 or higher. Plain HTTP connections are rejected at the edge.
• Encryption at rest: application data is stored in a managed PostgreSQL database with AES-256 encryption at rest applied by the hosting provider.
• Sensitive credential encryption: TOTP secrets and OAuth tokens (e.g. for Xero and HMRC integrations) are additionally encrypted at the application layer using AES-256-GCM before being written to the database.
• Automated backups: the managed database is backed up daily with point-in-time recovery available.
• File storage: uploaded documents (PDFs, images) are stored in an isolated object storage bucket with server-side encryption and no public access.
• Content validation: all uploaded files are inspected at the byte level (magic-byte sniffing) to verify the declared type matches the actual content before processing.
• Audit logging: all privileged administrative actions are written to a dedicated audit log table that is append-only by application design, with no delete path exposed through any API or admin interface.

AI processing (used for elements of the document extraction and analysis process) is handled via API calls. Invoice content is transmitted to these sub-processors over encrypted connections and is not used to train their models under the applicable enterprise agreements. See our Privacy Policy for the full sub-processor list.