Security

This page explains security measures, customer responsibilities and how to report security issues.

Webbuild applies technical and organisational measures to protect Webbuild Products and the services it operates for its software. Application controls include authenticated administration, protection of stored credentials, relevant operational event logging and rate limiting on the HMRC gateway. No online system can guarantee absolute security.

The public products.webbuild.eu platform is served over HTTPS. The managed HMRC gateway uses HTTPS/TLS for upstream communication. Retained HMRC application credentials use application encryption. Account passwords are stored using one-way password hashing.

Business Registry runs in the customer’s Perfex CRM. Provider credentials saved by the module use the host application encryption mechanism. The customer remains responsible for the security of the server, database, backups and administrative access.

We do not request or store a customer’s HMRC sign-in username or password. Managed HMRC application credentials are not returned to customers.

The gateway processes the VAT number and country code required for a requested check. During normal operation it does not intentionally persist HMRC lookup request or response bodies or log application secrets and access tokens.

Administrative access is restricted to authorised accounts. Do not share passwords, API keys or license secrets. If you suspect compromise, contact us and change affected credentials. Stored HMRC credentials can be cleared operationally when no longer needed.

Customers are responsible for their accounts and their own Perfex installation, server, database, network, backups and staff access. We recommend current supported software, restricted administrative access and regularly tested backups.

Report suspected vulnerabilities to [email protected]. Describe the affected area and reproduction steps without passwords, API secrets or unnecessary personal data. We assess reports and investigate credible findings. Do not perform tests that disrupt services or expose other users’ data.

When we become aware of an incident involving personal data for which Webbuild is responsible, we assess it and take the remediation and notification actions required by applicable law and our contractual responsibilities.

Business Registry integrates with HMRC services where configured. Webbuild is not HMRC-approved, accredited, certified, recognised or Kitemarked. Third-party providers control their own terms and service availability.

Last updated: 8 October 2026.