Encryption and Data Protection

WeFile handles two very sensitive classes of data: the credentials used to file on your behalf (Government Gateway user ID and password, Companies House authentication code) and your company's financial figures.

The credentials are encrypted at field level in our database, everything travels over TLS, and some sensitive things are deliberately never stored at all. This page describes what we actually do, including the limits.

The Government Gateway password and the Companies House authentication code are encrypted with AES-256-CBC before being written to our database, each with a fresh random initialisation vector. The key is derived from a secret that exists only in our server environment and is never stored in the database, so a copy of the database alone does not reveal them.

They are decrypted only at the moment a return is transmitted to HMRC or Companies House.

The Government Gateway user ID, UTR and director name are stored unencrypted because the system needs to read and validate them (they are identifiers, not secrets).

Only your own signed-in session can reveal them (in the filing's Credentials tab, dot-masked with a reveal button). WeFile staff cannot: administrator views, and any session where a member of our team is signed in as you for support, receive the value as "[REDACTED]" rather than the real one. Developer-API callers authenticating with an API key also read them back as "[REDACTED]".

There is one exception: if you file through an accountant's branded WeFile portal, that partner is acting as your filing agent and can see the credentials held against your filings in their portal.

You can delete stored credentials at any time, from the web app or through the developer API (the only time deletion is refused is while a submission is actually in flight).

Developer-API integrators can instead supply credentials with each submission request, in which case they are held in memory for that transmission only and never written to our database.

The OAuth access and refresh tokens for an HMRC Making Tax Digital VAT connection, and, for white-label partners, their Stripe secret key and SMTP host, username and password. All use the same AES-256-CBC field encryption.

• Accounting-software connections: when you import a trial balance from Xero, QuickBooks Online or FreeAgent, the access token is used for that import session and is not saved to our database.
• Filing documents: your CT600 PDF, iXBRL accounts and tax computation are generated on demand each time you ask for them, not kept in a document store.
• Card details: payments are handled by Stripe and full card numbers never reach our servers.

Account passwords are not encrypted, they are hashed one way with bcrypt, which means they cannot be read or recovered by anyone at WeFile, only reset. Two-factor authentication (a time-based one-time code from an authenticator app) is available and recommended. Developer API keys are stored as bcrypt hashes too and the full key is shown only once, at creation.

The whole site and API are served over HTTPS/TLS, and submissions to HMRC's GovTalk service and to Companies House are made over TLS.

We keep the exact envelope sent to HMRC or Companies House so a filing can be evidenced later, but the credential elements inside it (sender ID, authentication value, Companies House authentication code) are replaced with "[REDACTED]" before it is stored.

The return itself is retained verbatim alongside a SHA-256 digest of it, and HMRC's signed IRmark receipt is stored, so the submission remains independently verifiable without keeping the secrets.

Attachments such as charity accounts PDFs and support-ticket files are held in Cloudflare R2 object storage, encrypted at rest by the storage provider, and referenced by long unguessable URLs. We advise users not to share those links, and not to upload documents they do not need to send us.

Field-level encryption protects the stored secret, it is not end-to-end encryption, and it does not help if someone gets into your own account, which is why 2FA matters. Your financial figures (profit and loss, balance sheet) are not field-encrypted and can be read by authorised WeFile staff when investigating a filing you have asked us about.

If you have questions, or wish to report a suspected vulnerability, please email us directly at info@wefile.co.uk rather than disclosing it publicly.

Company: WeFile Limited (Company No. 17080509)
Registered Address: 20 Wenlock Road, London, England, N1 7GU
ICO Registration Number: ZC104632

For more information on how we handle personal data, please see our Privacy Policy or Contact Us.