Trust
Security at SelfSubmit
We protect your account and tax records with layered authentication, monitoring, and encryption. Manage your security from Dashboard → Settings.
Account security features
The following controls are built into SelfSubmit today:
Strong password hashing
Passwords are hashed by Clerk using industry-standard one-way algorithms — never stored in plain text.
Email verification
New accounts must verify their email address before certain features (such as email OTP) can be enabled.
Password reset
Self-service password reset is available on the sign-in page and from your account Security menu.
Login limits
Sign-in API endpoints are rate-limited per IP to reduce brute-force and abuse.
Lockout (brute-force protection)
After repeated failed sign-in attempts, accounts and IP addresses are temporarily locked (typically 30 minutes). This complements Clerk Attack protection — Clerk does not always show a separate “brute force” toggle.
Session expiry
Idle sessions are signed out automatically after inactivity (default 30 minutes, configurable). Clerk also manages session lifetime.
Secure cookies
Session cookies use HttpOnly and Secure flags in production. Application cookies (such as active business selection) use HttpOnly, SameSite=Lax, and Secure in production.
Two-factor authentication (2FA)
Authenticator app (TOTP) and email OTP are enabled. SelfSubmit requires 2FA before using the dashboard and submissions.
Bot & attack protection
Clerk Attack protection (bot detection) is enabled. SelfSubmit also applies its own rate limits and temporary lockouts after failed sign-in attempts.
Login history
Recent successful and failed sign-in attempts are logged and visible under Settings → Login protection.
Device alerts
Sign-ins from a new device or network trigger security alerts on your dashboard. Failed-attempt bursts also raise alerts.
Session inactivity defaults to 30 minutes with a 2-minute warning. Signed-in users can review login history and alerts under Settings.
Encryption & storage
- All traffic uses HTTPS (TLS encryption in transit)
- Sensitive tax identifiers (UTR and National Insurance number) are encrypted at the application layer before storage
- Receipts and documents are stored in secure object storage linked to your account
- Submission history and business records are held in a managed PostgreSQL database
Payments
Card payments are processed by Stripe. SelfSubmit does not store your full card number. Billing uses Stripe's PCI-compliant checkout and customer portal.
Infrastructure
- Cloud application hosting with CDN and serverless infrastructure
- Managed PostgreSQL database hosting
- Authentication via Clerk; email via Resend; optional SMS reminders
- Technical error monitoring and reliability diagnostics
Your responsibilities
- Use a strong unique password and keep your authenticator app or email OTP access secure
- If you lose your phone, use email OTP or password reset to recover access
- Sign out on shared devices and report suspicious alerts promptly
- Ensure figures submitted to HMRC are accurate
Report a vulnerability or incident
Security researchers: see our Responsible disclosure policy. Account concerns: email support@selfsubmit.co.uk.