Trust & security

Your financial data, kept safe

FTrakhandles your income, expenses and tax records — so security isn't a feature, it's the foundation. Here's exactly how we protect your account and your data.

Encrypted in transit

All traffic is served over HTTPS with HSTS. Your data is encrypted between your device and our servers.

Strong authentication

Passwords are hashed with bcrypt. Optional two-factor authentication (authenticator app), passkeys (WebAuthn) and one-time recovery codes protect your account.

Sessions done right

Sign-in uses HTTP-only, secure cookies that JavaScript can’t read, with CSRF protection on every change and instant session revocation.

HMRC fraud-prevention

When you file, we send HMRC’s required fraud-prevention headers — a documented anti-fraud measure that helps HMRC detect misuse. Validated against HMRC’s own checker.

Your data is yours

Export everything to CSV or PDF at any time. Delete your account with a 30-day recovery window before data is permanently purged.

UK GDPR & ICO

We process data under UK GDPR and the Data Protection Act 2018, keep a Data Protection Impact Assessment, and run a documented breach-response procedure.

Least data, least sharing

We only collect what the service needs, never sell your data, and use no third-party advertising or cross-site tracking cookies.

Rate limiting & hardening

Authentication and sensitive endpoints are rate-limited, and the app ships with a strict set of security response headers.

Making Tax Digital & HMRC

FTrakconnects to HMRC using OAuth 2.0 — we never see your Government Gateway password. Tokens are stored encrypted, and every submission carries HMRC's required fraud-prevention headers. HMRC recognition is in progress; the software already files VAT and Self Assessment updates under Making Tax Digital against HMRC's systems.

Regulatory status — why we're not FCA-regulated

FTrak is software — not a bank, a payment provider, or a financial-services firm. The Financial Conduct Authority (FCA) regulates specific activities such as holding client money, giving investment advice, lending, insurance, and processing payments. FTrak does none of these:

  • We never hold or move your money. Subscription payments are handled by Stripe, an FCA-authorised payment provider.
  • We don't give investment, insurance or credit advice, and we don't lend.
  • Keeping digital records and filing them to HMRC under Making Tax Digital is not, in itself, a regulated financial activity.

For those reasons FTrak is not authorised or regulated by the FCA — and does not need to be. If we add bank feeds in future, they will be provided through an FCA-authorised open-banking partner, so that permission sits with the regulated provider rather than with us. FTrak is a tool to help you keep records and file them; it is not a substitute for professional tax or financial advice, and you don't need an accountant to use it — though you may choose to consult one if your affairs are complex.

Reporting a vulnerability

Found a security issue? Please email support@ftrak.app with the details and we'll respond quickly. Please don't publicly disclose it until we've had a chance to fix it.

See also our Privacy Policy, Cookie Policy and data complaints process.