Changelog

• Fixed: a data export scoped to a single organisation could still include firm-wide sections. Scope is now honoured exactly — an organisation-scoped export contains that organisation and nothing else.
• Fixed: some calculation records were silently omitted from exports. All TOMS and Partial Exemption calculations belonging to the exported organisations are now included.
• Erasure requests are now verified to target a member of the requesting firm before anything is deleted, with the check enforced both in the app and in the database.

• Public forms — beta signup, contact, newsletter, feedback and guide downloads — are now rate-limited server-side per IP and per email address, so automated submissions can no longer flood the queue.
• Invitation links now stop working the moment they are cancelled, accepted or expired, and the public lookup returns the same generic response in every case so tokens cannot be probed.
• Erasure requests now report every failed step instead of reporting success, and stay open until the erasure genuinely completes.
• Closed an open-redirect gap on the authorisation screens: cross-origin destinations are checked against a fixed allowlist before any navigation happens.
• Completed HTML escaping in generated audit-pack reports and tightened dependency versions.

• Fixed: a firm that subscribed during its trial could be suspended when the trial clock ran out if the payment confirmation had not yet been processed. Subscriptions are now verified with Stripe first, and a paying firm is moved straight to active.
• If we cannot reach Stripe — or payments are temporarily unconfigured — accounts are now left untouched and logged rather than being suspended on incomplete information.
• Connecting an accounting platform now requires an existing account and firm membership; accounts are no longer created implicitly from a connection callback.
• Disconnecting an organisation is now a soft removal: access tokens are revoked and cleared and the organisation disappears from your dashboard and your bill, but the underlying records are retained for the 6-year HMRC period.
• Compliance erasure failures now return a generic message with a reference code, with the detail kept in our internal logs.

• Connecting an organisation that takes you into a higher pricing band now shows the new price, the pro-rata amount due today and the next renewal date — and asks you to confirm before anything is charged.
• Practices are billed per live organisation, and seat counts now update automatically as organisations are added.
• Downgrades are never applied mid-cycle: removing organisations schedules the lower band to take effect at your next renewal, so you keep what you have already paid for.
• Training organisations and your own practice organisation are excluded from pricing entirely.
• A nightly reconciliation compares what Stripe is charging against what your account should be on, and any drift is now visible to our team in the admin billing view.

• Fixed: firms enrolled in the TOMS beta could be shown the "not available yet" gate and locked out of the module when their access relied on the global beta defaults. Beta eligibility is now resolved server-side, so enrolled firms get straight in.

• The advisory role is now enforced consistently on the server: advisory users can view calculations, periods and reports, but cannot recalculate, post journals, or connect or disconnect an accounting platform.
• Attempts are refused up front with a clear "Access denied" message rather than failing part-way through an operation.

• OneSixth's ICO registration (ZC197273) and VAT registration number (523 3658 94) now appear on our legal pages and in the site footer.
• The ICO certificate, sub-processor list and an independent infrastructure scan summary are downloadable from the Trust Centre — most of what a due-diligence questionnaire asks for, in one place.

• Accessibility improvements throughout: proper page headings, correct autofill hints on forms, larger touch targets, improved colour contrast, and a cookie control that no longer covers the element you're focused on.
• Wide TOMS and Partial Exemption tables now reflow into stacked cards on narrow screens, so nothing is clipped or hidden behind a horizontal scroll on a phone.

• Our HMRC connection now reports multi-factor authentication events (passkeys) along with the full set of required client-context details, validated against HMRC's own fraud-prevention header checker — a condition of continued MTD access.

• All transactional emails — invites, confirmations, reminders and alerts — now share a consistent OneSixth-branded layout with clearer headings and footers, so they're easier to recognise and less likely to be filtered as spam.

• New: connect AI agents to your account. Assistants that speak the Model Context Protocol (MCP) — such as Claude, ChatGPT and Cursor — can now securely read and act on your VAT data through a set of purpose-built tools (list organisations, read HMRC VAT obligations and periods, detect your MTD stagger, sync HMRC data, and post a provisional TOMS journal).
• Scoped access tokens. You mint tokens from Settings → Agent integrations, and each token is pinned to one firm, an optional organisation allowlist, and a chosen set of capability scopes — read (look up data), trigger (run safe syncs and detections), and write (post journals). An agent can only ever do what its token allows.
• Tokens are stored only as a hash (the secret is shown once, at creation), and you can set an expiry and revoke any token at any time. Write and trigger actions run through the app's existing guarded, idempotent posting pipeline, so all the usual safety and audit checks still apply — an agent never bypasses them.
• New: connect external MCP servers. Admins can register outside MCP servers so the app can call their tools during its own workflows, with all connection handshakes handled server-side.

• Fixed: after reconnecting a reset or regenerated organisation (for example the Xero Demo Company, which gets a new identifier each time it's reset), the old connection could linger as a duplicate in your dashboard. Connections are now reconciled against Xero's live list on every reconnect, and any organisation Xero no longer recognises is flagged as disconnected and hidden.
• Disconnecting an organisation now uses Xero's recommended per-connection removal rather than token revocation, so disconnecting one organisation never affects the others sharing your login.
• A new weekly background check reconciles every connected organisation against Xero and prunes connections that have had no activity for over 45 days — keeping your list accurate without any action from you.

• VAT/tax-code mapping now explains each option in-app: tooltips on the Sales → supply type and Purchase → attribution columns spell out what every code means.
• Corrected the help guide's code descriptions — B is Blocked (not "Both") and N is Outside scope (not "Non-business") — and expanded it to describe every supply type and attribution.
• Fixed: the Total income and Total input VAT checksum boxes on the historic-period form appeared blank for figures of £1,000 or more; they now display correctly at any amount.

• VAT codes with no transactions are now hidden by default, so you only map the codes you actually use (toggle to show all).
• Codes are grouped sales/income first, then purchases/costs, so you can work through them in a logical order.
• Suggested mappings appear inline for unmapped codes — apply them individually or in bulk — and the suggestions learn from your choices over time.
• Sales/purchase mismatches are flagged (for example, a purchase attribution set on a sales code) so mapping mistakes are caught early.
• You're now warned when a used code hasn't been mapped, including a heads-up on the period page when a new period contains an unmapped code.

• Fixed: pages sometimes opened part-way scrolled down because the previous scroll position carried over. Navigating to a new page now starts at the top (in-page anchor links still jump to their target).
• Help articles can now be read in a side panel without navigating away from your current work — open a relevant article inline, or jump to the full article when you need it.

• Fixed: the suggested recovery figure on the historic-period form ignored the de minimis test. When a period qualifies as de minimis under VAT Notice 706 §11, the suggestion now correctly recommends 100% recovery of all input VAT instead of the partial figure.
• The hint text now makes clear whether the suggestion is a de minimis (full recovery) or a standard-method (percentage recovery) figure.

• Fixed: historic periods with newly entered figures sometimes failed to save ("couldn't save period").
• Period start/end now use calendar date pickers, and the end date auto-fills a standard 3-month quarter from the start.
• New faded, read-only checksums total your income and input VAT so you can cross-check the figures against the return.
• Clearer reverse-charge / postponed-import (PIVA) guidance: never enter RC/PIVA deemed output as taxable income — only the related input VAT, split across Taxable / Exempt / Residual.

• New guidance in the TOMS area explains how to code your day-to-day TOMS sales and purchases (use the No VAT rate) so the margin and its VAT aren't double-counted on your return.
• Second-hand margin schemes (motor, general goods, global accounting, horses) now have a dedicated VAT-rate setup step on Xero, so margin journals post cleanly the first time.
• FreeAgent is now supported for margin journals: choose a default sales category (and override it per journal), with a clear, persistent reminder to adjust Box 6 manually.
• Fixed: the FreeAgent Box 6 reminder now quotes the correct figure — the margin-scheme value (gross sales less the margin VAT), not the full selling price.

• Partial Exemption setup now shows what your accounting platform reports about your VAT return frequency and period stagger in a single card, immediately before the stagger section.
• The detected frequency and stagger are pre-selected for you; if you choose a different value, a short notice confirms you're overriding what the platform reported.
• Removed the duplicate detection box so the accounting-platform check appears once.

• Old, withdrawn UK VAT rates (17.5%, 15%, 12.5% and 8%) are now hidden from the tax-code list so you only see rates in current use.
• Fixed those historic rates being wrongly flagged as special-method "hybrid" codes, which exposed a recovery-percentage field that shouldn't have appeared.
• The recovery % override now only shows for genuine partial-exemption special-method codes, with new help text explaining how it's used. Existing mis-flagged rows are corrected on the next tax-code sync.

• Refreshed every scheme guide to match the current product — Partial Exemption now covers the full setup wizard, tax-code mapping, transaction classification, de minimis, the annual adjustment and SMO; TOMS, Motor Trade and the second-hand goods schemes gained the detail that was missing.
• New articles: Training sandbox, Compliance centre (SARs, erasure, exports, retention) and Accountant portfolio.
• Added an HMRC Making Tax Digital preview page covering the stagger detection, filing reconciliation and VAT calendar that are on the way.
• The in-app help drawer now surfaces the right article on the training, portfolio, compliance, connections and passkeys pages.

• New Training sandbox for practising any VAT scheme against deterministic dummy data — nothing is ever posted to a real accounting platform.
• A persistent banner makes it obvious when you're working in demo data, so it can't be confused with a live client.
• Progress tracking lets you work through each scheme end to end at your own pace.
• See the Training sandbox help article for a walkthrough.

• OneSixth now opens the VAT return you'd ordinarily be preparing — the most recently ended period — instead of the period that simply contains today's date.
• If that return's filing deadline has already passed, you're asked whether to prepare the overdue return or skip ahead to the current period. Deadlines follow HMRC's 1 month + 7 days rule (2 months for the Annual Accounting Scheme).
• In Partial Exemption setup, the starting recovery % is now only requested when your in-year recovery method needs one, so the wizard asks for less when it doesn't apply.
• Fixed: "TOMS margin" no longer appears as a supply type for businesses that don't use TOMS.

• First-year clients with no prior-year recovery % can now record a use-based (intended-use) recovery rate — and it's reachable whichever in-year method you choose, including "recalculate each period".
• You can note the basis for the intended-use percentage, so the reasoning is captured for HMRC.
• New annual de minimis election: recover 100% of input VAT in-year and review the position at the annual adjustment.
• Calculations now show whether full recovery was actually taken in the period, and flag any additional recovery expected at the annual adjustment for deferred periods.

• You can now add historic VAT periods when adopting Partial Exemption part-way through a tax year, so the annual adjustment spans the whole year correctly.
• Prior periods can be back-filled with their actual recovery figures, and the annual adjustment trues up against them rather than assuming a full year of in-app data.
• See the Partial Exemption guide for how mid-year adoption is handled.

• Passkey sign-in now runs on Supabase's built-in WebAuthn support, so sign-in is faster and the security-critical verification is handled by the platform.
• You can now rename your passkeys, and each one shows an automatic name based on where it's stored (e.g. iCloud Keychain, Google Password Manager).
• As part of this upgrade, any passkey created before today needs to be set up again once from Settings → Passkeys. You can still sign in with your email link or connected account in the meantime.

• New Connections hub brings every connected accounting platform — Xero, QuickBooks Online, Sage and FreeAgent — into one place to view status, reconnect or revoke access.
• Each connection shows its health at a glance so expired or broken authorisations are easy to spot and fix.
• See Connecting your accounting platform for what we read and how to manage access.

• Posting a provisional, year-end or deferral journal is now idempotent — if a request times out or is retried, you'll never end up with a duplicate journal in your accounting platform.
• Records can no longer get stuck in a "posting" state after an interrupted post; they either complete cleanly or return to draft so you can safely try again.
• Applies across all schemes (TOMS and Partial Exemption) and every connected platform — Xero, QuickBooks Online, Sage and FreeAgent.

• Clearer in-app banners for trial, payment and renewal status so it's obvious where your subscription stands and what to do next.
• Background reliability and billing improvements so plan changes from the Stripe Customer Portal apply correctly and payment issues clear automatically once resolved.

See Subscription status — what each banner means for a plain-English breakdown.

• New signup flow asks whether you're a Practice, Business or Charity so we can route you to the right plan and pricing.
• Charity sign-ups can enter their UK charity registration number — we verify it and apply a 25% discount, retroactive to the date you submitted the number.
• New Plan settings page to switch plan family at any time.

• New public roadmap showing what's live, in progress, planned and under consideration across the schemes and platforms.
• You can submit feature requests and upvote the ideas that matter most to you, so we can prioritise what to build next.

Our Data Processing Agreement is now available as a downloadable PDF, linked from the Privacy Policy and Terms & Conditions for procurement and supplier-due-diligence reviews.

Existing users without a registered passkey now see a one-time post-sign-in prompt encouraging them to set up Touch ID, Face ID or Windows Hello for faster future access.

• New Compliance centre giving firms the tools to meet UK GDPR and HMRC obligations in one place.
• Handle subject access requests, action right-to-erasure requests, export data, and track the 6-year HMRC retention schedule, all backed by an audit log.
• See the Compliance centre guide for how each workflow works.

• New problem-statement section explaining why standard accounting software falls short for VAT margin schemes and TOMS.
• "Talk to us" contact modal with demo booking, email, WhatsApp and a stay-in-touch form.

Single sign-on is live for Xero and Intuit (QuickBooks) accounts. New users can spin up a firm in seconds without setting a password.

Register a passkey from Settings → Passkeys and sign in with Touch ID, Face ID, Windows Hello, or a hardware security key — no password required.

• Launched the de minimis editorial blog at /blog.
• New Help centre with per-scheme guides for TOMS, Motor Trade, Global Accounting, Horses & Ponies, General Goods, and Partial Exemption.
• Added a /support contact form.
• In-app contextual help drawer (the ? button in the header) and feedback widget.

• Refreshed landing-page metadata (title, description, Open Graph, canonical) for multi-platform support and Partial Exemption.
• Added sitemap.xml, an updated robots.txt, and an llms.txt for LLM crawlers.
• Article and FAQ JSON-LD on blog posts and help articles so LLMs can extract content reliably.
• Per-route SEO metadata across blog and help, plus a 1200×630 Open Graph image.

• New Trust Centre hub linking security, sub-processors and legal docs.
• Security page covering RLS, AES-256 encryption, EU hosting and vulnerability disclosure (security@onesixth.app, security.txt).
• Versioned Sub-processors register (Supabase, Stripe, Resend, Lovable) with UK IDTA / SCC safeguards.
• UK GDPR Article 28 Data Processing Agreement, incorporated into the Terms by reference.
• Rewritten Privacy Policy (controller/processor split, lawful-basis table, 6-year HMRC retention schedule, DPO contact) and updated Cookie Policy and Terms & Conditions (99.5% uptime target, 30-day data export, 30-day notice for material changes).

• OneSixth now connects to QuickBooks Online, Sage Business Cloud Accounting and FreeAgent alongside Xero.
• Platform-agnostic schema (connected_organisations, platform_* identifiers) with parallel OAuth flows and journal posting per platform.
• All margin schemes and Partial Exemption route automatically to the correct platform handler.

• End-to-end Partial Exemption support under HMRC VAT Notice 706 — setup wizard, transaction pull, classification, quarterly provisional calculation and journal posting.
• Annual adjustment with Standard Method Override (SMO) and de minimis tests.
• Available across Xero, QuickBooks Online, Sage and FreeAgent from day one.

New portfolio view for accountants managing multiple client entities — see scheme status, period progress and outstanding actions across every connected organisation in one place.

• Reconciliation panel auditing VAT return figures against posted Xero journals.
• Method 1 departure-date deferrals with explicit release workflow.
• One-click year-end audit pack export.
• Amendment tracking via UpdatedDateUTC with provisional-vs-final variance reporting.

• Global Accounting — 1/6 total-margin formula with negative carry-forward and closing rules.
• General Goods — 1/6 per-item margin with import workflow and missing-data checks.
• Horses & Ponies — specialised identifiers, BETA forms and breeding-eligibility rules.

• Vehicle Stock Book with margin formula, system-generated stock references and XLSX reports.
• DVLA Vehicle Enquiry Service integration for automatic vehicle metadata.
• Cost-resolution hierarchy: Stock Book → Xero Items → manual entry.

OneSixth launched with the Tour Operators' Margin Scheme on Xero — Simplified Method, quarterly provisional calculations, year-end adjustments, full audit log and 14-day free trial.