How we handle your data

The number one question we get: "Can I trust you with my credentials?" Here's exactly how DormantFile handles your HMRC Gateway login and Companies House authentication code.

HMRC login never stored

Your HMRC login — the Government Gateway user ID and password — is entered once, when you file your Company Tax Return (CT600) or the Partnership Tax Return (SA800) if HMRC has asked your LLP to file one. We use it to send the return to HMRC over an encrypted connection and discard it from server memory the moment HMRC responds. It is never written to our database.

Auth code stored only if you choose

Your six-character Companies House authentication code is entered at the point of accounts filing and is not stored in our database unless you choose to save it for autopilot. If you do save it, it is encrypted at rest (AES-256-GCM) and never logged. You can see whether it is stored and remove it any time from the company's settings — removing it deletes it immediately and permanently and turns autopilot off. Turning autopilot off without removing the code keeps it saved so you can re-enable in one click.

Encryption in transit

All data between your browser and our servers is encrypted using TLS. Your credentials travel over the same encrypted channel to HMRC and Companies House. At no point is sensitive data transmitted in plain text.

Secure password storage

Your DormantFile account password is hashed using bcrypt before it is saved. We never store it in plain text. Even if our database were compromised, your password could not be recovered.

Minimal cookies

Three essential cookies (session, CSRF protection and login redirect) keep you signed in safely. A few more are set only in specific moments — during a Google sign-in, if you arrive by a referral link, or when you use a free tool (including the free letter reader). Google Analytics and Google Ads measurement cookies are set only if you consent, and never used to target ads at you. See our cookie policy for details.

When you file a Company Tax Return (CT600) — or the Partnership Tax Return (SA800), if HMRC has asked your LLP to file one — we ask for the company's HMRC login: its Government Gateway user ID and password. We use them once, at the moment of filing, to sign the return and send it to HMRC over an encrypted connection. As soon as HMRC responds, they are discarded from server memory. They are never written to our database, never logged, and never accessible to our team.

How we handle your Companies House authentication code

When you file dormant company accounts, we ask for your six-character Companies House authentication code. This code is entered at the point of filing and transmitted to Companies House as part of the submission. Like your HMRC credentials, it is not stored in our database unless you enable annual autopilot (see below) — and it is never logged or accessible to our team.

Annual autopilot (optional storage)

If you choose to save your Companies House authentication code, we store it so future autopilot filings can be submitted when you confirm by email each year. This is entirely opt-in — if you never save it, it is never stored. The code is encrypted at rest using AES-256-GCM and is never logged.

You can see whether the code is stored and remove it at any time from the company's settings page. Removing it deletes it immediately and permanently and turns autopilot off. Turning autopilot off without removing the code keeps it saved so you can re-enable in one click — giving you explicit control in both directions.

Signing in with Google

If you use "Continue with Google", we never see your Google password. Google confirms who you are and sends us your name, email address and a stable account identifier, which is all we keep. Your DormantFile account then has no password of its own, so the protection on your Google account — including two-step verification — is what protects it. If your Google account is compromised, treat your DormantFile account as compromised too and contact us.

What data we store

We store only what is needed to run the service:

Your email address and hashed password (for your DormantFile account) — or, for a Google sign-in, Google's account identifier instead of a password.
For an LLP filing an SA800: the partnership UTR and each member's name and personal UTR, encrypted at rest.
Conversations with the compliance assistant, encrypted at rest.
Letters you upload to the letter decoder: the images, held in private file storage in the UK rather than our database, and the reading we produce from them, encrypted at rest. Deleted when you delete the letter or your account.
Penalty appeal letters: the facts you confirm and the finished letter, encrypted at rest. Where an appeal describes serious illness or bereavement, that paragraph is additionally hidden from our own team — only the business owner can reveal it, and every reveal is logged.
Your company details: name, registration number, UTR, and accounting period dates.
Filing records for accounts, CT600 and SA800 submissions: what was filed, when, and the response from HMRC or Companies House.
Stripe customer ID for billing (card details are held by Stripe, not us).

Third-party services

HMRC — receives your company details and Gateway credentials during CT600 or SA800 filing.
Companies House — receives your company details and authentication code during accounts filing.
Stripe — processes payments. They hold card details, not us.
Resend — delivers every email we send: account and filing emails, plus deadline reminders and register alerts (which you can turn off any time) and any offers or product news you haven't opted out of.
Anthropic, via Vercel's AI Gateway — the AI model that answers the compliance assistant and reads uploaded letters. Your data is not used to train it.
Pingen — prints and posts an appeal letter, but only if you ask us to send one for you. Print it yourself and nothing is sent to them.
Vercel — hosts the application and holds uploaded letters in private file storage, both in the UK.

For the full legal detail, read our privacy policy.

Beyond data security

Protecting your data is one half of trust; knowing who we're filing for is the other. We run our own anti-money laundering and due-diligence checks on every filing — verifying the company against the live Companies House register, confirming who's filing, and watching the register daily for signs of company hijack. Read our anti-money laundering policy for exactly what we check.