Security

If you think you have found a security problem in CabBooks, or you are worried about the safety of your data, email security@cabbooks.online. You don't need an account. Please include enough detail for us to see the problem for ourselves.

We will reply within five working days and tell you what we are doing about it. Please don't make the problem public before we have had a chance to fix it.

We don't run a bug bounty, so we can't offer money or rewards for reports.

We won't deal with anyone acting in bad faith, for example by asking for payment before telling us about a problem, or to keep it private. We may report this to the police.

Every account must use two step verification. Until it is set up, our database refuses access to your data. A stolen password on its own gets nothing.

We never store your password. We keep only a scrambled version that can't be reversed.

You sign in to HMRC on HMRC's own page, opened in your phone's secure browser. We never see your Government Gateway user ID or password.

Once you give permission, HMRC gives us a key that lets CabBooks act for you. It is kept in a separate encrypted store that only our servers can read. It is deleted when you delete your account.

The database itself only lets you reach your own records. This doesn't rely on the app getting it right.

We test this automatically. The tests sign in as one driver and try to read and change another driver's records. Every attempt must be refused.

Every connection is encrypted. That includes your phone to our servers, and our servers to HMRC. Our database is in London and is encrypted when stored.

Our database is backed up every day. Each backup is kept for 7 days, then deleted.

Your records are not stored on your phone. The app reads them from our servers when you open it. Your sign in is kept in your phone's secure storage.

When you export your records, the file is deleted from the app as soon as you have shared or saved it.

We test CabBooks ourselves using recognised security testing tools, and fix what they find.

CabBooks is run by a small team. Only the people who need it can get into our systems, and they must use two step verification to do it. There is no staff tool that can open your records.

We only look at your data to help with a problem if you ask us to. Our privacy policy explains who else processes your data for us.