Security Policy

1. Overview

ClearYear takes the security of your data seriously. This policy describes the technical and organisational measures we use to protect your information.

2. Data Transmission

• All data is transmitted over HTTPS (TLS 1.2+) — never plain HTTP
• HTTP Strict Transport Security (HSTS) is enforced with a 1-year policy
• SSL certificates are automatically renewed

3. Data Protection

• NINO and UTR are hashed with SHA-256 before any storage — plaintext identifiers are never written to disk
• Income, expense, and calculated tax figures are retained against your submission record after your session ends (not just held transiently) — see our Privacy Policy for the full detail on what's stored and why
• HMRC OAuth access tokens are held on our server only for the duration of your submission attempt and are wiped immediately once it completes — success or failure — rather than being kept around until they naturally expire
• Session cookies are HttpOnly, Secure, and SameSite=Lax

4. Application Security

• Rate limiting — all endpoints are rate-limited per IP to prevent brute force attacks
• SQL injection protection — we use an ORM with parameterised queries throughout, so raw SQL is never built from user input; JSON request bodies and query parameters are additionally scanned for injection patterns as a defense-in-depth layer
• XSS protection — Content Security Policy headers are enforced on all responses
• Clickjacking protection — X-Frame-Options: DENY (and the modern CSP frame-ancestors equivalent) is set on all pages
• Duplicate/amendment detection — repeat submissions for the same return are detected; you're prompted to confirm an amendment, and a maximum number of corrections is enforced
• Audit trail — all submission events are logged with IP address and timestamp

5. Payment Security

All payments are processed by Stripe, a PCI DSS Level 1 certified provider. ClearYear never handles or stores card numbers, CVV codes, or bank details. Stripe's security policy applies to all payment data.

6. Infrastructure

• Hosted on Railway, which holds SOC 2 Type II and SOC 3 certification
• Environment variables and secrets are never committed to source code

7. Vulnerability Disclosure

If you discover a security vulnerability, please report it responsibly to support@clearyear.co.uk. We will acknowledge your report within 48 hours and aim to resolve confirmed issues promptly.

8. Contact

ClearYear · Andrean Tahchiev (Sole Trader)
Email: support@clearyear.co.uk