Security & data handling

Customer data is hosted at rest in the UK (AWS London). AI processing takes place in the US under UK GDPR safeguards — see our Sub-processors page.

Data is encrypted in transit using TLS 1.2 or higher, and encrypted at rest.

Access to client files is restricted to authorized customer users and, where necessary, a limited number of authorized GAIN Tax personnel for support, maintenance, or security purposes.

GAIN Tax uses role-based access controls to ensure users can access only the data and functions required for their role.

GAIN Tax maintains logging and audit trails for key system activity, access events, and security-relevant operations to support monitoring, investigation incidents, and accountability.

Customer data is retained only for as long as necessary to provide the service, comply with legal obligations, and meet operational requirements. Data is deleted or securely removed in accordance with defined retention and deletion procedures.

GAIN Tax supports GDPR-aligned handling of customer data, including processes for access, correction, export, and deletion requests, subject to applicable legal and regulatory requirements.

Our sub-processor list is published at gaintax.co.uk/sub-processors

Our Data Processing Agreement is published at gaintax.co.uk/data-processing-agreement

Customer data is never used to train AI models. This is a contractual commitment in our Terms of Use and DPA, and we prohibit our sub-processors from doing so.

GAIN Tax maintains incident response procedures for the timely identification, containment, investigation, remediation, and notification of security incidents where required.

GAIN Tax maintains backup and disaster recovery measures to support resilience, business continuity, and restoration of critical data and services.