Security

Email security@ownproperly.com with a description of the issue, steps to reproduce, and any proof-of-concept material.

We acknowledge reports within 1 business day and aim to resolve material issues within 30 days.

We commit not to pursue legal action against good-faith researchers who follow coordinated disclosure (give us a reasonable window to fix before public disclosure). With your permission we'll credit you publicly once the issue is resolved.

We don't currently run a paid bug bounty. We're happy to discuss recognition / thanks on a case-by-case basis.

A machine-readable disclosure file is available at https://ownproperly.com/.well-known/security.txt.

If we suffer a personal-data breach that is likely to result in a risk to the rights and freedoms of natural persons, we will:

— Notify the UK Information Commissioner's Office (ICO) within 72 hours of becoming aware, as required by UK GDPR Article 33.
— Notify affected customers directly by email and an in-app banner within 72 hours.
— If we file via HMRC's Making Tax Digital APIs and the breach affects HMRC-submitted data, notify HMRC via the Developer Hub support ticket process within 72 hours, per the Terms of Use we agreed to.
— Publish a public post-mortem within 30 days of resolution covering: what happened, what data was affected, the timeline, what we changed, and our advice to customers.

Your data is held in Supabase (a Postgres database, file storage and authentication service) running on AWS infrastructure in the EU West (London) region. Backups stay in the same region.

Some sub-processors (Stripe, Anthropic) transfer data to the United States under UK-approved transfer mechanisms (Standard Contractual Clauses + UK Addendum).

In transit: All connections to OwnProperly use TLS 1.2 or higher. HSTS is enforced with a 2-year max-age. The TLS certificate is managed by Vercel via Let's Encrypt.

At rest: The Postgres database and file storage are encrypted at rest using AES-256 via AWS RDS / S3 standard volume encryption.

Application-level encryption of OAuth tokens (HMRC, Plaid, Xero): Currently in development. Tokens are stored in a row-level-security-protected table with limited service-role access. We are migrating to application-layer envelope encryption (key separate from the database) before applying for HMRC production credentials.

Passwords: Never stored in plaintext. Supabase Auth uses bcrypt with a per-user salt.

— All tables use Postgres Row Level Security so users can only read their own data.
— SECURITY DEFINER functions have explicit search_path locks to prevent privilege-escalation attacks.
— Service-role keys are kept server-side only — never sent to the browser.
— Edge functions verify a valid Supabase JWT before any user-scoped action, except for webhook endpoints that authenticate via signed payloads.
— Multi-factor authentication is available to all accounts (recommended for any user filing to HMRC).

— Significant platform actions (auth events, payment events, MTD submissions, data deletions) are written to an append-only audit log.
— Edge-function and database errors are captured in Supabase observability and reviewed regularly.
— Failed-login attempts are rate-limited at the auth layer.

A full and current list of sub-processors is published in our Privacy Policy. We update the list whenever it changes.

We commission third-party penetration tests prior to each material expansion of HMRC API scope, and at least annually thereafter. Reports are available to enterprise customers under NDA on request.

We follow the UK ICO Data Protection Self-Assessment Toolkit on a rolling basis and review the checklist at each significant feature release.

— UK GDPR / Data Protection Act 2018
— HMRC Developer Hub Terms of Use (Making Tax Digital integration)
— Open Banking PSD2 — via FCA-regulated AISP Plaid Financial Ltd
— UK PECR (cookies and direct marketing) — we use only essential cookies, no tracking cookies

security@ownproperly.com for security reports and questions.
hello@ownproperly.com for everything else.