Security

HMRC Making Tax Digital

Fynmerge supports Making Tax Digital (MTD) — the UK government's programme to modernise the tax system. Our platform:

• Tracks MTD for Income Tax quarterly obligations for sole traders and landlords.
• Tracks VAT return and Self Assessment deadlines.

Open Banking security

Fynmerge connects to your bank via Open Banking, regulated in the UK under the Payment Services Regulations 2017 (PSR). This means:

• Bank connections are established via TrueLayer, an FCA-authorised Account Information Service Provider (AISP) — Firm Reference No. 901096.
• We have read-only access to your transaction data — we can never move money.
• Your bank login credentials are never shared with or stored by Fynmerge.
• You consent directly through your bank's own secure interface.
• You can revoke access at any time from within your bank or Fynmerge settings.

Data security

• Encryption in transit: All data is transmitted over TLS.
• Encryption at rest: Our database provider (Supabase) encrypts data at rest.
• Token encryption: Access tokens for connected bank and accounting services are encrypted with AES-256-GCM at the application layer.
• Authentication: Sign-in is handled by Supabase Auth; passwords are stored hashed with bcrypt.
• Access control: Every data request is scoped to your organisation — users can only access their own organisation's data.
• Infrastructure: Hosted on Vercel, Render and Supabase.

Responsible disclosure

If you discover a security vulnerability in Fynmerge, please report it responsibly to contact@fynmerge.com. We'll acknowledge your report promptly and keep you updated while we investigate.

Compliance

• Open Banking integration via TrueLayer, which is FCA-authorised under the Payment Services Regulations 2017.

Contact

For security or compliance questions: contact@fynmerge.com