Journal

Written for the people who build the software.

Security and HMRC compliance notes for tax and accounting software vendors. Every figure sourced, nothing gated, no sales call needed to read a date.

HMRC6 min read

HMRC requires penetration testing. It has never checked whether you did one.

HMRC's Terms of Use require MTD software providers to test for security vulnerabilities before going live, including regular penetration testing. At production approval HMRC verifies your fraud prevention headers, with a specialist team reading your sandbox logs, and asks nothing about the security testing. One requirement is policed. The other is a box you tick.

3 August 2026Read

Compliance7 min read

Do you need a CREST accredited tester for your tax software?

In the ordinary case, no. HMRC's Terms of Use require regular penetration testing but name no accreditation scheme. Fortbridge, itself a CREST accredited firm, states that ISO 27001 and SOC 2 do not mandate CREST specifically. CREST is mandatory for CBEST, STAR-FS, government and MoD contracts, and DORA. Here is who genuinely needs it, and what to ask a supplier instead.

27 July 2026Read

Pricing7 min read

What a penetration test costs in the UK, and what each price band buys

A UK web application penetration test costs roughly £2,500 to £8,000, rising to £8,000 to £15,000 where customer financial data is involved. Below about £500 a day you are buying an automated scan with a report attached. What moves the number, and the one question people forget to ask.

20 July 2026Read

Security6 min read

The security questionnaire that stalled your deal, and the one question behind it

Vendor security questionnaires are one of the most common reasons a B2B software deal stops just before signature. Usually one question does it: attach your most recent independent penetration test report. What to say when you have not got one, and how to stop it happening again.

13 July 2026Read

Compliance8 min read

Do you need a penetration test for ISO 27001, SOC 2, PCI DSS or NHS DTAC?

ISO 27001 never uses the words. SOC 2 does not formally require one. PCI DSS v4.0 genuinely does, under Requirement 11.4, annually and after significant change. NHS DTAC wants a test within 12 months. What each standard says, what auditors actually expect, and whether CREST matters.

6 July 2026Read

HMRC7 min read

HMRC fraud prevention headers: what they are, and what happens when you get them wrong

MTD software is required by law to send fraud prevention headers with every HMRC API call. A £3,000 penalty applies to developers who fail to support the requirement, and continued non compliance can get your software blocked from HMRC's APIs entirely. HMRC checks them once, at production approval, and never again.

29 June 2026Read

Security6 min read

Your development agency marks its own homework. Here is what that costs.

If an outside agency built your platform, the only people who can tell you whether it is secure are the people you paid to build it. That is a conflict of interest rather than dishonesty, and it produces a specific class of error. Five questions to ask them, and when an independent check is worth it.

22 June 2026Read

Security8 min read

What a security review of tax software actually covers

Tax software combines personal financial records, a payment gate and a live government API. A review that treats it as a generic web application misses the two surfaces that matter most. The six surfaces worth testing, what a report should contain, and what it costs in the UK.

15 June 2026Read

Ownership7 min read

Build vs buy: when should an accountancy firm build its own practice software?

Most firms should buy off the shelf practice software first. But once you are paying for several tools, working around rigid workflows, and adding staff just to keep admin moving, building the workflow you own becomes the simpler, cheaper option. Here is how to tell which side of the line your firm is on.

8 June 2026Read

MTD8 min read

Making Tax Digital for Income Tax: every deadline a UK practice needs in 2026

MTD for Income Tax starts on 6 April 2026 for sole traders and landlords with qualifying income over £50,000. The first quarterly update is due by 7 August 2026. Here is the full timeline, who is in scope, and what it does to a practice's workload.

1 June 2026Read

Ownership7 min read

Rented vs owned: what per-seat practice software really costs a growing firm

Per-seat practice software is rented: you pay every year, the price rises with headcount, and the roadmap is not yours. A custom platform you own costs more up front and less over time. Here is the honest comparison, including when renting is the right call.

25 May 2026Read