Encryption and Data Protection

WeFile handles two very sensitive classes of data: the credentials used to file on your behalf (Government Gateway user ID and password, Companies House authentication code) and your company's financial figures.

The credentials are encrypted at field level in our database, everything travels over TLS, and some sensitive things are deliberately never stored at all. This page describes what we actually do, including the limits.

The Government Gateway password and the Companies House authentication code are encrypted with AES-256-CBC before being written to our database, each with a fresh random initialisation vector. The key is derived from a secret that exists only in our server environment and is never stored in the database, so a copy of the database alone does not reveal them.

They are decrypted only at the moment a return is transmitted to HMRC or Companies House.

The Government Gateway user ID, UTR and director name are stored unencrypted because the system needs to read and validate them (they are identifiers, not secrets).

The same approach applies to personal tax (SA100): your National Insurance number and your Government Gateway password are encrypted at field level with AES-256-CBC, using the same server-only key and per-record initialisation vector. Your Unique Taxpayer Reference (UTR) and Government Gateway user ID are stored unencrypted, as identifiers rather than secrets.

Only your own signed-in session can reveal them (in the filing's Credentials tab, dot-masked with a reveal button). WeFile staff cannot: administrator views, and any session where a member of our team is signed in as you for support, receive the value as "[REDACTED]" rather than the real one. Developer-API callers authenticating with an API key also read them back as "[REDACTED]".

There is one exception: if you file through an accountant's branded WeFile portal, that partner is acting as your filing agent and can see the credentials held against your filings in their portal.

The same rule applies to personal tax filings: only the taxpayer's own signed-in, non-impersonated session can receive the plaintext National Insurance number or Government Gateway password. Administrators, team collaborators with access to a shared client, and impersonated support sessions all receive "[REDACTED]" instead of the real value.

Team members with editor or admin access to a shared personal tax client can update the stored Government Gateway credentials on the owner's behalf, but even they only ever get back "[REDACTED]", never the plaintext they just saved. These updates are refused outright while an HMRC submission for that return is actively in progress. WeFile administrators cannot view or edit the plaintext either, but can flag a return as needing updated credentials, which sends the taxpayer an email prompting them to update them.

You can delete stored credentials at any time, from the web app or through the developer API (the only time deletion is refused is while a submission is actually in flight).

Developer-API integrators can instead supply credentials with each submission request, in which case they are held in memory for that transmission only and never written to our database.

The OAuth access and refresh tokens for an HMRC Making Tax Digital VAT connection, and, for white-label partners, their Stripe secret key and SMTP host, username and password. All use the same AES-256-CBC field encryption.

• Accounting-software connections: when you import a trial balance from Xero, QuickBooks Online or FreeAgent, the access token is used for that import session and is not saved to our database.
• Filing documents: your CT600 PDF, iXBRL accounts and tax computation are generated on demand each time you ask for them, not kept in a document store.
• Card details: payments are handled by Stripe and full card numbers never reach our servers.
• Personal tax preview documents: SA100 preview PDFs and tax computations are generated on demand each time you view or download them, and are not kept in a document store.

Account passwords are not encrypted, they are hashed one way with bcrypt, which means they cannot be read or recovered by anyone at WeFile, only reset. Two-factor authentication (a time-based one-time code from an authenticator app) is available and recommended. Developer API keys are stored as bcrypt hashes too and the full key is shown only once, at creation.

The whole site and API are served over HTTPS/TLS, and submissions to HMRC's GovTalk service and to Companies House are made over TLS.

For Corporation Tax (CT600) and Companies House filings, we keep the exact envelope sent to HMRC or Companies House so a filing can be evidenced later, but the credential elements inside it (sender ID, authentication value, Companies House authentication code) are replaced with "[REDACTED]" before it is stored.

The return itself is retained verbatim alongside a SHA-256 digest of it, and HMRC's signed IRmark receipt is stored, so the submission remains independently verifiable without keeping the secrets.

Personal tax (SA100) live submissions to HMRC use your own stored Government Gateway user ID and password, decrypted only immediately before transmission, exactly like Corporation Tax. As with Corporation Tax, the envelope sent and HMRC's response are retained with the credential elements redacted, alongside a SHA-256 digest of the submitted body and HMRC's signed IRmark, so a submission remains independently verifiable without keeping the secrets. Separately, our own internal recognition tests against HMRC's test ("ETS") environment are fully isolated: they use backend-only test credentials, never your stored Government Gateway password, and never touch HMRC's production Transaction Engine.

Attachments such as charity accounts PDFs and support-ticket files are held in Cloudflare R2 object storage, encrypted at rest by the storage provider, and referenced by long unguessable URLs. We advise users not to share those links, and not to upload documents they do not need to send us.

Field-level encryption protects the stored secret, it is not end-to-end encryption, and it does not help if someone gets into your own account, which is why 2FA matters. Your financial figures (profit and loss, balance sheet) are not field-encrypted and can be read by authorised WeFile staff when investigating a filing you have asked us about.

If you have questions, or wish to report a suspected vulnerability, please email us directly at info@wefile.co.uk rather than disclosing it publicly.

Company: WeFile Limited (Company No. 17080509)
Registered Address: 20 Wenlock Road, London, England, N1 7GU
ICO Registration Number: ZC104632

For more information on how we handle personal data, please see our Privacy Policy or Contact Us.