Trust and security

Where the data comes from

Everything we show about a company comes from official public sources. Every figure carries its source and date, and where a record is missing we say so rather than estimate it.

Companies House

The register of UK companies, their officers, owners (PSC), filings, charges and filed accounts. A sync job runs every day and loads each monthly snapshot when it is published; records are refreshed from the Companies House API in between.

The Gazette

The official public record: winding-up petitions, administrations, liquidations and strike-off notices, matched to the company they concern.

Sanctions lists

The UK Sanctions List published by the Foreign, Commonwealth and Development Office (it includes the UN Security Council designations the UK gives effect to), and the US OFAC SDN and Consolidated lists. Every screening result names the lists checked and the date of each. A name match is a prompt to check, not a finding.

Our own work on top

Financial figures parsed from accounts filed in iXBRL, and a rules-based health score with the reasons behind it. The score is an indicator, not a credit rating. How the score works.

Account security

• Two-step sign-in

  Turn it on in Settings → Security with any authenticator app. You get ten single-use recovery codes in case you lose your phone.

• HTTPS everywhere

  Every page and API call is encrypted in transit, and browsers are told never to connect without HTTPS (HSTS).

• Passwords hashed with scrypt

  We store only a salted scrypt hash, never the password itself, and we never send passwords by email.

• API keys stored as hashes

  A key is shown to you once, when you create it. We keep only its SHA-256 hash, and you can revoke a key at any time.

Where your data is kept

Payments

You pay on Stripe's own checkout page. Your card details go straight to Stripe; we never see or store your card number.

Free plans need no card. Pay monthly or yearly, and cancel a paid plan any time from your billing page: it runs to the end of the period you paid for. Invoices are in your billing page.

Cancellation and refunds policy

Backups and monitoring

• Nightly backups

  The database is backed up every night. Each backup is checked for completeness before it is kept, and a failed backup alerts us straight away.

• Monitored every two minutes

  The website, the API, the daily data sync, payment notifications, certificates and backups are checked around the clock, and any problem alerts us straight away.

Verifying a PDF report

Company reports, KYB certificates and invoices carry a reference, a QR code and a SHA-256 fingerprint, so anyone you send one to can check it came from us and has not been changed.

1. 1

   Find the reference printed on the PDF, next to its QR code.

2. 2

   Scan the QR code, or open https://api.companystack.co.uk/verify/ followed by the reference. The page confirms who the document is about, when it was made and its fingerprint.

3. 3

   To check the file itself, compare its SHA-256 fingerprint with the one shown: sha256sum report.pdf on Mac or Linux, or certutil -hashfile report.pdf SHA256 on Windows.

Try it on a sample report

Privacy and legal documents

Our documents are published in full, and every past version stays available, so you can see what applied when. Where we process personal data on your behalf, such as your team members' details, the Data Processing Agreement applies as part of the Terms.

• Terms of Service
• Privacy Notice
• Cookie Policy
• Data Processing Agreement
• Sub-processors
• Acceptable Use Policy
• Cancellation and refunds

To use your data protection rights (access, correction, deletion and the rest), email support@companystack.co.uk or download your data and delete your account yourself in Settings.

Reporting a security problem