Security posture
What was reviewed, and what is protected
ChainTax handles sensitive tax records. This page states the scope of its published security claim without presenting a code review as a certification or a guarantee.
April 2026
Recorded code review; no public attestation
Project records state that an April 2026 route-by-route code review covered authentication, authorisation, user-owned data access, validation, rate limits, payments, queue boundaries, deletion, and concurrency-sensitive writes. No reviewer identity, signed report, or independently inspectable attestation is published. This is not a penetration test, not a certification, and not a guarantee that the service has no vulnerabilities.
Current controls
Wallet access
Public wallet addresses only. ChainTax never asks for a seed phrase, private key or signing permission.
Authentication and data
Authentication and the primary database are provided through Supabase. Protected routes check the signed-in user before reading account data.
Payments
Stripe handles card details. ChainTax stores payment references and tax-year access records, not card numbers.
Application controls
Production uses a Content Security Policy, HSTS, frame denial, request validation, rate limits and signed webhook/queue boundaries.
Quality checks
5,400+ automated tests cover tax logic, classifiers, pricing, reports, API routes and important failure cases.
Report a security issue
Email hello@chaintax.co.uk with a clear description and reproduction steps. Do not access another user's data, disrupt the service, or publish a vulnerability before there has been time to investigate it.
For product limitations and tax-method detail, see the methodology and limitations.