Security, data & compliance
How we protect your data, our approach to UK GDPR, connecting to HMRC safely, and how to report a security issue.
How your data is protected
- Data is encrypted in transit (TLS), and sensitive credentials — including HMRC access tokens — are encrypted at rest.
- Each customer’s data is logically separated so it cannot be accessed by other customers.
- Access to production data is restricted on a least-privilege, role-based basis.
- Valix connects to HMRC using OAuth 2.0, so your Government Gateway password is never stored.
UK GDPR & your data
You control your data. You can export your records, and you can request deletion. Our Privacy Policy explains what we collect, why, and your rights under UK data-protection law.
Reporting a security issue
If you believe you have found a vulnerability, please tell us so we can investigate and fix it. Our full responsible-disclosure process and machine-readable contact details are on the Security page.
Related pages
See the Security, Privacy Policy and Terms of Service pages for the full detail.
Frequently asked questions
Can I get a copy of all my data?
Yes — you can export your records, and request deletion of your data.
How do I report a security problem?
Email our support team with the details, or use the contact in our security.txt. We aim to acknowledge reports within two business days.
Related guides
Still need a hand?
Our UK support team can help with your account.