Security

If you find a security vulnerability in Cabbooks, or you are a customer with a concern about the safety of your data, please email security@cabbooks.online. Please include enough detail for us to reproduce the issue. We will acknowledge your report and let you know what we are doing about it.

Please do not publicly disclose a vulnerability before we have had a chance to fix it.

All traffic between your browser and Cabbooks is encrypted using TLS. There is no way to reach the service over an unencrypted connection.

Cabbooks connects to HMRC using OAuth 2.0. We never see or store your Government Gateway user ID or password. HMRC handles your sign-in directly, and only ever gives us a token to act on your behalf.

That token is encrypted a second time, independently of the database it is stored in, before it is saved. Losing access to the database alone would not be enough to read it.

Your ledger and business records are protected by row-level security rules enforced by the database itself, not just by the application code that talks to it. A request for your data has to be authenticated as you to succeed, at the database layer, regardless of what the calling code asks for.

We have tested the site using an independent security scanning tool.

Cabbooks is a small team. Access to customer data is limited to the people who need it to build and support the product, and is not shared with anyone else.