How EasyAcco handles your financial data
Tax calculations run in your browser. As a guest, your records are saved encrypted in this browser only. If you sign in, every change you make is synced to your account in Supabase automatically. Three things send data to a server: account sync, the Payslip Reader, and an HMRC submission you choose to make.
Tax estimates are worked out in your browser. The figures you type into a calculator are not sent to a server.
As a guest, your records are saved encrypted in this browser and survive between visits. Nothing is sent to our servers, so we have no copy. Clearing site data deletes them.
Once you sign in, each invoice, expense, journey and ledger row you save is synced to your account automatically. Guest records made before signing in are not copied across.
Where data is stored, it lives in Supabase — SOC 2 Type II compliant, encrypted at rest (AES-256) and in transit (TLS 1.3).
EasyAcco does not embed tracking pixels, analytics SDKs, or ad networks. Your browsing behaviour on this platform is not monetised.
Accounts use an email and password or a one-time email link, handled by Supabase Auth. Your password goes from your browser straight to Supabase, which stores it hashed; it never reaches our server. Optional two-step sign-in adds a code from an authenticator app: once it is on, your records need the code — enforced by the database, not just the screen — and connecting to or filing with HMRC always needs it.
The copy of your expenses, invoices, mileage and ledger held in this browser is stored in IndexedDB, encrypted with an AES-GCM 256 device key generated on first use. The key is marked non-extractable — it cannot be read or exported, not even by this app's own code. For a guest this is the only copy. For a signed-in account the records are also held in Supabase, where they are encrypted at rest by Supabase, not with this device key.
The trade-off: clearing site data or switching browsers loses access to the key, and therefore the data. Use Settings → Backup to export a passphrase-protected snapshot. The passphrase derives a separate key via PBKDF2 (310,000 iterations, SHA-256) — keep it somewhere safe; it cannot be recovered.
EasyAcco has no AI features enabled and sends your data to no AI provider. Receipt OCR runs entirely in your browser via Tesseract — the photo never leaves your device. The Payslip Reader is the one feature that does upload: the image is sent to our own server, read once and discarded — never stored, never logged, never passed to a third party — and using it is optional, since every figure on a payslip can be typed in by hand. Your transactions, invoices and ledger are never transmitted to any third party other than HMRC, and then only for a return you actively choose to file.
Questions? Contact us at baradfiona14@gmail.com — or read the full privacy notice, which sets out every recipient of your data and your rights under UK GDPR.
EasyAcco is independent software. It is not produced, endorsed or approved by HM Revenue & Customs.