Free tool

How safe is your VAT setup?

A general guide based on HMRC and NCSC guidance.

Where VAT data risks really come from

  • Shared passwords: a Government Gateway password shared with staff, a bookkeeper or a tool gives full access to your tax affairs.
  • Phishing: fake HMRC emails and texts that ask you to sign in or claim a refund. HMRC's guidance on scams lists what HMRC will and will not send.
  • Spreadsheets sent by email: files sent to the wrong address, or left in inboxes for years.
  • One copy of your records: a lost laptop or failed drive with no backup.
  • Shared logins: when everyone uses one login, no one knows who changed what.

What to check in any cloud VAT software

CheckWhy it matters
It is on HMRC's software finderIt has been through HMRC's recognition process for MTD
You sign in to HMRC on HMRC's own pageThe software gets permission to file, never your Government Gateway password
Every page uses httpsYour data is encrypted while it travels between you and the software
Each person has their own loginYou control who has access, and can remove someone who leaves
You know what it storesAccounting software holds every transaction. Bridging software may hold only your return totals
You can get your data outYou can leave without losing your records

Ask the provider directly about anything their website does not answer. A provider that cannot tell you how sign-in to HMRC works is not one to trust with it.

Habits that protect your VAT data

  1. Never share your Government Gateway password. If an accountant files for you, they should use their own agent services account, linked to your business.
  2. Use a strong, unique password for your VAT software, and a password manager to keep track of them.
  3. Turn on two-step sign-in wherever it is offered, starting with your email account, because that is how passwords get reset.
  4. Keep a backup of your records somewhere other than one computer. HMRC expects you to keep VAT records for 6 years.
  5. Check before you click. Go to HMRC or your software by typing the address, not by following a link in an unexpected email.
  6. Remove access for staff and advisers who no longer need it.

How Swift VAT Pro handles your data

  • HMRC sign-in: you connect on HMRC's own page with your Government Gateway user ID. Swift VAT Pro never sees that password.
  • Your records stay with you: Swift VAT Pro is bridging software. Your records stay in your spreadsheet, and it holds your business details, the nine box totals you upload and HMRC's receipt for each return.
  • Your Swift account: every page runs over https, and practice plans give each team member their own login.
  • Your HMRC account in view: once connected, you see your VAT periods, due dates, amounts owed and payments, read from HMRC.

Moving from other software? See how to switch VAT software safely.

Sign in through HMRC, file from your spreadsheet, from £5 a month

Swift VAT Pro never sees your Government Gateway password, and your records stay in your own spreadsheet.

  1. Connect to HMRC on HMRC's own page with your Government Gateway sign-in. We never see that password.
  2. See your VAT periods, due dates, amounts owed and payments, read from HMRC.
  3. Upload your nine box totals as a CSV. Box 3 and Box 5 are worked out and every box is checked.
  4. Submit and keep HMRC's receipt. Reminder emails arrive before each due date.
Start your 7-day free trialSee how it works

No card needed · From £5 a month · Plans for up to 100 businesses · Filing through HMRC's MTD service since 2019

Final thoughts

Cloud VAT software is safe when it signs you in through HMRC, uses https and gives each person their own login. Most real risks come from shared passwords, phishing and single copies of records, so the habits above matter as much as the provider you choose.

Disclaimer: This guide gives general information, not advice for your business. If you are unsure how the rules apply to you, speak to an accountant or contact HMRC.

Frequently asked questions

Checked against HMRC's software finder, HMRC guidance on suspicious emails, the NCSC Small Business Guide and VAT Notice 700/21. November 2026.

Is cloud VAT software safe?
It can be. Check it is on HMRC's software finder, that you sign in to HMRC on HMRC's own page, that every page uses https and that each person has their own login. Most real risks come from shared passwords, phishing and single copies of records.

Should VAT software ask for my Government Gateway password?
No. Software should send you to HMRC's own sign-in page, so it gets permission to file without ever seeing your password.

Should I share my Government Gateway login with my accountant?
No. An accountant or agent should use their own agent services account, linked to your business.

How long do I need to keep VAT records?
HMRC expects you to keep VAT records for 6 years. Keep a backup somewhere other than one computer.

How do I spot a fake HMRC email?
Be wary of unexpected emails or texts that ask you to sign in, give personal details or claim a refund. Go to HMRC by typing the address yourself, and report suspicious messages to HMRC.

Sign in through HMRC and file from your spreadsheet, from £5 a month.

Swift VAT Pro files your return to HMRC from the spreadsheet you already keep. From £5 a month.

Start 7-day free trial Check how safe your VAT setup is

No card needed · 2,900+ VAT returns filed since 2019