Privacy Policy & Data Security
nochase is purpose-built for UK accounting practices. Your client tax files, AML proofs, and practice records are encrypted at rest (AES-256) and in transit (TLS 1.3) within UK data centers.
1. Data Processor Commitment
nochase Ltd ("nochase", "we", "our") acts as a Data Processor under UK GDPR and the Data Protection Act 2018 for accounting practices ("Data Controllers") using our document collection platform. We process client documents strictly in accordance with your practice instructions.
2. HMRC 6-Year Statutory File Retention
Under HMRC record-keeping regulations, UK accounting records and tax evidence must be preserved for at least 6 years from the end of the tax year. nochase automatically maintains encrypted file archives for 6 statutory years on all paid practice plans, with automated 90-day expiry notifications for identity verification documents (COIs, passports, MLR 2017 proofs).
3. Security & Encryption Architecture
- Encryption in Transit: TLS 1.3 encryption across all upload portals and magic link endpoints.
- Encryption at Rest: AES-256 multi-tenant isolation with Supabase Row-Level Security (RLS).
- Virus & Malware Screening: Real-time ClamAV antivirus scanning on every incoming file upload before storage.
- Data Residency: UK / EU-West data residency to guarantee full compliance with UK ICAEW & ACCA practice guidelines.
4. Zero-Login Token Security
Client upload magic links use cryptographically random high-entropy tokens with configurable link expiration times (default 14 days). Once uploaded, clients cannot view prior practice submissions without authorized re-authentication, preventing unauthorized cross-client exposure.
5. ICO Registration & Contact
nochase is registered with the Information Commissioner's Office (ICO) as a data processor. For data protection inquiries or Data Processing Agreement (DPA) requests, please contact our Data Protection Officer at privacy@nochase.co.uk.