Security
Filing software sees sensitive details: your company's figures, tax reference and the codes that authorise filings. This is how FileMyLtd treats them.
Last updated 6 November 2026
Credentials are used once, then discarded
Your HMRC online login is needed to send a CT600. FileMyLtd uses it for that single submission and doesn't save it. Companies House presenter details are entered by you when you submit or check a filing, rather than held on your behalf.
Two-factor sign-in
Accounts use a password of at least 12 characters, and an authenticator app (TOTP) is required before anyone can approve or submit a filing. Backup codes are provided when two-factor is set up, and sensitive actions, such as changing a UTR or submitting, ask you to confirm again. Sign-in and sign-up are protected against automated abuse with Cloudflare Turnstile and rate limits.
Encryption
All traffic uses HTTPS. The company UTR is encrypted with AES-GCM before it is stored, with the encryption key held separately from the database, and is shown afterwards only as its last two digits.
Where data is held
The database and filed documents are stored in Cloudflare's EU jurisdiction, and the application runs with a placement hint close to London. Copies of what was sent to Companies House and HMRC are kept so you can see exactly what was filed.
You stay in control
Nothing is filed automatically. The accounts and returns you approve are the ones that are sent, and every submission needs your declaration. Software, including any AI features, prepares and explains; it never approves or submits.
Reporting a vulnerability
If you think you've found a security issue, email hello@filemyltd.co.uk with the details. Please don't access other people's data or disrupt the service while testing. Reports are acknowledged and fixed as a priority.