Your accounts, your control.
Security starts with how access works. Where the work needs one of your accounts, you invite us from that account, at the access level the job needs: read-only for banks and cards. Your passwords stay with you, and you can remove our access at any time.
Access by invitation · your passwords stay with you · two-step portal sign-in
Access map
- Bank & cardsBusiness accounts and cards Read-only MFA ✓
- Your recordsListed in your written quote Sent by you MFA ✓
Your controls
- Invited from your account ✓
- Passwords stay with you ✓
- Filed only on your approval ✓
- Remove access any time ✓
Invited by you, at the level each job needs.
You invite us read-only from your own accounts, so your passwords stay with you.
Banks and cards
Read-onlyIf the work needs your bank or card accounts, you invite us read-only. With read-only access, money moves only when you move it.
Your records
Sent by youYou send the records listed in your quote once you accept it. We tell you what's missing.
Your returns
Your approvalA second person reviews each return. Each return goes to HMRC after you approve it.
Your money stays in your own accounts; you approve and send every payment.
Your documents, behind two-step sign-in.
Documents, messages, reports and invoices live in your client portal at portal.limenorth.com. These controls are built into it.
Two-step sign-in
Email link + app codeThe portal is by invitation only. You sign in with a one-time email link and a code from an authenticator app. The database itself refuses data to a session that has not passed both steps.
Your company only
Enforced in the databaseRow-level rules in the database tie every record to its client, so each client reaches only its own documents, messages and reports.
Private file storage
2-minute linksFiles sit in private storage. Each one opens through a link made when you click, which stops working after 2 minutes.
Who viewed your files
Visible to youEvery view and download of your files is recorded with a name and time, and you can read that record in your portal.
Download all your records from the portal at any time.
Controls built into the work.
Who hosts your data.
Connections to this website and to the portal are encrypted with HTTPS (TLS 1.2 or newer), and browsers are told to use the encrypted connection every time.
Supabase
Database, files and sign-in · US EastSupabase states that all customer data is encrypted at rest with AES-256 and in transit via TLS, that it is SOC 2 Type 2 compliant and that it is ISO 27001 certified.
Vercel
Runs the portal applicationVercel states that data is encrypted at rest (AES-256) and in transit, that it has a SOC 2 Type 2 attestation and that it is ISO 27001:2013 certified.
Resend
Sends portal emailsResend states that it provides encryption at rest (AES-256) and in transit, and that it is SOC 2 Type II compliant.
Certifications above are each provider's own, as stated on its security page. Links are in the sources below.
You can remove our access at any time.
Every connection lives in your own accounts, so you can remove it yourself, whenever you choose. When an engagement ends, we remove ourselves from each one.
- Access granted by your invitation
- Removable from your own accounts
- Every filing approved by you before it is sent
- We remove ourselves when an engagement ends
How long we keep what you send.
Client records
7 yearsKept for 7 years after our engagement ends, or for the period your engagement letter states.
More detail is in our privacy policy.
If something goes wrong
If we confirm that your information was accessed without permission, we tell you within 72 hours: what happened, what it affected and what we are doing about it.
Reporting a security concern
Spotted something that looks wrong, in the portal or on this site? Email us and we'll look into it: hello@limenorth.com
Request our security overview.
A short document for you or your advisers: how the portal protects your data, who hosts it, and the written policies we keep. Email us and we'll send it.
Sources
- Supabase: Security · fetched 23 October 2026
- Vercel: Security · fetched 23 October 2026
- Resend: Security · fetched 23 October 2026
Questions about access and security
What access do you need?
You send the records listed in your written quote. Where the work needs one of your accounts, you invite us from that account at the level it needs: read-only for banks and cards.
When is anything filed?
Each return goes to HMRC after you approve it.
Do you use multi-factor authentication?
Yes. Everyone who signs in to the client portal, client or team member, uses a one-time email link and an authenticator app code, and we use multi-factor sign-in on the accounts we use to reach your records.
Where is my data stored?
Documents and messages you send through the portal are held by Supabase in its US East region. The portal runs on Vercel, and portal emails are sent through Resend.
Can I remove your access?
Yes, at any time, from your own accounts. Each connection is an invitation you sent, so you can remove it yourself whenever you choose.
What happens when an engagement ends?
We remove ourselves from each of your accounts. Client records are kept for 7 years after our engagement ends, unless your engagement letter states a different period.
Tell us where you sell. You'll get a plan and a price in writing.
A 20-minute call or a short email, then a written quote: your plan, any add-ons and the price in pounds sterling.
Book a 20-minute callWritten quote first · pay in GBP against your invoice