Security and vulnerability reporting
Savy handles tax records on behalf of its customers. If you have found a security problem, we want to hear about it quickly and we will treat you fairly.
Report a vulnerability or incident
Email security@savy.tax. This address is read by the people who run Savy's systems, not a general inbox. It is also published in machine-readable form at /.well-known/security.txt.
Please include:
- what you found and where (a URL, an API endpoint or a message flow);
- the steps needed to reproduce it;
- whether any customer data was visible to you, and if so what kind, without sending us copies of it;
- a way to reach you for follow-up questions.
How we handle a security incident
We keep a written incident response process. When a report suggests personal data may be at risk, we contain the problem first, then investigate, then notify: affected customers, the Information Commissioner's Office within 72 hours where the breach is likely to result in a risk to people's rights, and HM Revenue & Customs (HMRC) within 72 hours for anything concerning the security of taxpayer data handled through its systems. Every incident ends with a written review and the changes we made as a result.
How Savy protects your data
- All traffic is encrypted in transit with TLS. Data is encrypted at rest, and identifiers such as National Insurance numbers and bank details are additionally encrypted at the field level with keys kept in a separate vault.
- HMRC access uses OAuth 2.0. Savy never sees or stores your Government Gateway user ID or password; HMRC issues Savy a limited, revocable token instead.
- Each customer's records are isolated by database row-level security. Staff access is role-based, limited to what a job needs and logged.
- We use automated dependency checks to identify known software vulnerabilities.
Other contacts
- Privacy and data-protection requests
- privacy@savy.tax
- General support
- hello@savy.tax