Security

Hosting & data residency

OneSixth runs on Supabase infrastructure (Postgres, Edge Functions, Authentication) hosted in the European Union. Your VAT and accounting data is stored within the EU. Some sub-processors may process limited data outside the UK/EU — see the sub-processors page.

Encryption

• In transit: TLS 1.2+ on all connections to the application, API, and accounting platforms (Xero, QuickBooks Online, Sage, FreeAgent).
• At rest: AES-256 encryption for the underlying database and storage volumes.
• Secrets: OAuth refresh tokens and API keys are stored in encrypted columns or Supabase secrets and never exposed to the browser.

Multi-tenant isolation

Every row of customer data is tagged with a firm and organisation identifier. Postgres Row-Level Security (RLS) policies enforce that users can only read or write rows belonging to firms they are members of.

Edge Functions authenticate the caller from their JWT and then perform data access using a server-side service-role key. Because that key operates above RLS, every such function applies its own explicit firm and organisation authorisation check before reading or writing, and those checks are centralised in a shared authorisation module rather than reimplemented per endpoint.

A small number of endpoints are intentionally public — the marketing contact and newsletter forms — and these can only write to dedicated tables that hold no customer VAT or accounting data.

Authentication

• Supabase Auth with email/password, Google SSO and Xero SSO.
• Passkey (WebAuthn) support for additional account protection.
• Session tokens are stored as httpOnly-friendly Supabase cookies; we do not place credentials in localStorage beyond what Supabase requires for the SDK.
• Roles are held in a dedicated user_roles table and resolved server-side on every request — never read from client-supplied data. OneSixth supports three roles: admin (full access including connecting and disconnecting accounting platforms), member (can calculate and post VAT journals) and advisory (read-only — can view calculations and reports but cannot recalculate, post journals, or change platform connections).

Audit logging

Meaningful actions on VAT periods (calculations, journal posts, deferrals, year-end adjustments) are written to an append-only audit log keyed by firm, organisation, user, period and action. Administrative actions on compliance requests (data exports, erasures) are logged separately. This supports a 6-year HMRC retention window.

Backups & recovery

The Postgres database is backed up by Supabase with point-in-time recovery available on supported plans. We retain operational backups for the period required to meet our recovery objectives and the 6-year retention obligation for HMRC records.

Change management

Code changes are version-controlled, code-reviewed, and deployed through automated pipelines. Database schema changes are applied as migrations and reviewed before release.

Application security controls

• OAuth state nonces on all accounting-platform connections, and noopener on cross-origin links.
• Strict input sanitisation for spreadsheet exports (XLSX) to prevent formula injection.
• Server-side enforcement of period locks once a VAT return has been filed — a filed period cannot be recalculated or re-posted.
• Least-privilege use of the service-role key: it is used only in server-side Edge Functions and is never present in the browser bundle.
• Rate limiting on authentication and outbound-email endpoints.

Security testing & vulnerability management

We run continuous automated security analysis across the OneSixth codebase and infrastructure, covering:

• Static analysis (SAST) of application and server-side function code
• Dependency scanning for known CVEs in third-party packages
• Secrets detection across the repository and its history
• Cloud posture monitoring of our Supabase and source-control configuration
• AI-assisted code review for authorisation, tenancy-isolation and business-logic flaws

Findings are triaged against the deployed code rather than accepted at face value, and confirmed issues are tracked to closure. Our current remediation targets are:

We do not currently commission third-party manual penetration testing. Where a customer's own due-diligence process requires it, we're happy to discuss scope and timing.

Incident response

If we become aware of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where the breach concerns data touching our HMRC integration, notify HMRC within 72 hours — and, where required, notify affected customers without undue delay. You can report a suspected security issue at any time to security@onesixth.app. We maintain an internal incident response process covering detection, containment, eradication, recovery and post-incident review.

Responsible disclosure

If you believe you've found a security vulnerability, please email security@onesixth.app or message us on WhatsApp at +44 7822 012268. We follow a coordinated disclosure approach: please give us a reasonable opportunity to investigate and remediate before public disclosure (we aim for 90 days). Please do not access data that is not yours, and avoid degradation of service. We thank researchers acting in good faith and will not pursue legal action against them.

Our disclosure contact is also published at /.well-known/security.txt.

Certifications

We do not currently hold a SOC 2 or ISO 27001 certification. Our underlying platform provider (Supabase) holds SOC 2 Type II and ISO 27001 certifications covering the infrastructure we build on. We can share our security documentation and answer due-diligence questionnaires on request — contact security@onesixth.app.