Keeping your business records safe

With your email address and password, then a second step. The second step is one of these:

• a passkey, such as your phone’s fingerprint or face unlock, or a security key; or
• a six-digit code from an authenticator app on your phone.

Everyone who uses OpenQuotes has to set up a second step. We can exempt a single account by hand, but an exempt account cannot connect to HMRC or send a VAT return.

When you set up your second step, OpenQuotes offers you a set of one-time recovery codes, for the day you lose your phone. Keep them somewhere safe.

If someone keeps trying to guess a password, or keeps asking for password reset emails, OpenQuotes limits how many tries it accepts, then refuses for a while.

Each device you sign in on has its own sign-in. That means:

• Logging out ends the sign-in on our server, not just in your browser. Your other devices stay signed in.
• Every sign-in ends after 30 days, however often you use it. Then you sign in again.
• Changing your password signs you out on every other device. Do this if you lose a phone or laptop.

• We never see your HMRC password. You sign in to HMRC on HMRC’s own website, and HMRC gives OpenQuotes a key to act for your business. That key is encrypted before we store it.
• Your second step is needed to work with HMRC. OpenQuotes only contacts HMRC from a sign-in that used your passkey, your authenticator app or a recovery code. Before a return is sent, it asks for your passkey or authenticator app again, unless you used one in the last 15 minutes. A recovery code alone cannot send a return.
• Only the people you choose can submit. Each person in your business has a role, and only roles with permission to file VAT can submit a return.

There is more about this on our filing VAT returns page.

No. Your business records, such as quotes, jobs, invoices, bank lines, the ledger and VAT returns, each belong to one business, and the database itself checks that on every request. Even if our own code asked for another business’s records by mistake, the database would return none.

A few things are kept apart by our code instead of by the database: sign-in accounts, invitations, the security log, your business’s own details and the files you upload.

Inside your business, the owner, and anyone the owner allows to manage users, decides who is invited and what each person can do. For example, a bookkeeper can enter bills without being able to change who has access.

• While it travels: everything between your device and OpenQuotes is encrypted (HTTPS), and an ordinary web address is switched to the secure one. Our hosting provider’s data processing agreement confirms TLS 1.2 or higher.
• While it is stored: our database is encrypted using the Advanced Encryption Standard (AES), as set out in our hosting provider’s data processing agreement. Files you upload, such as photos and supplier invoices, are stored encrypted (AES-256).
• Extra protection for the most sensitive items: your HMRC key and your authenticator app set-up are encrypted again by OpenQuotes before they are stored.
• Passwords are never stored as written. We keep only a scrambled version (a “hash”) that cannot be turned back into your password.

Your business records are stored in Frankfurt, Germany, by our hosting provider, Render. Files you upload are stored by Cloudflare in storage restricted to the European Union. Our personal data page explains this in full, including the few things that are handled in the United States.

Our hosting provider backs up the database every day. We also keep our own encrypted backup copies in Microsoft OneDrive, stored in the UK, and on an encrypted external drive, so we never rely on one provider. Only the founder can open them.

You can also download your own copies at any time: your profit and loss and balance sheet as PDF, Excel or CSV, with the transactions behind them; your whole ledger as Excel; and each quote and invoice as a PDF.

OpenQuotes is a small company. Only the founder has access to the systems that run it, and those accounts are protected by a second sign-in step too. The behind-the-scenes admin screens are switched off on the live system, so they cannot be reached from the internet.

We only look at your records when you ask us to help, or when we have to in order to keep the service safe or working.

We don’t hold security certifications of our own, such as Cyber Essentials or ISO 27001. We would rather tell you exactly what we do than show a badge.

• Use a passkey if your phone or computer supports one. A fake website can’t trick it out of you the way it can a password or a code.
• Give everyone who works on your books their own login. Invite them from Settings; don’t share yours.
• Log out on shared computers.
• Keep your recovery codes somewhere safe, away from your phone.
• We will never ask for your password, your codes or your HMRC sign-in details, by email, phone or anything else.

Email [email protected] with “Security” in the subject. Tell us what you found and how to see it. We will reply within two working days.

Please don’t look at, change or keep anyone else’s data while checking, and don’t do anything that could slow the service down for others.

If your data is lost, exposed or changed without permission, we will tell you without delay and say what we are doing about it. Where the law requires it, we will report it to the Information Commissioner’s Office within 72 hours. If it could affect VAT returns sent to HMRC, we will tell HMRC too.