Security & verification

Got our letter and checking whether we're real?

Good instinct. Three checks that don't require trusting a word we say:

• Look us up on the government register: PromptFiling is a trading name of Northstar Infinity Works Ltd, company no. 17326480, England and Wales.
• Look your company's deadline up the same way, free, at find-and-update.company-information.service.gov.uk — our letter should match it exactly, because that is where it comes from.
• A person answers: PromptFiling is run by Adam Sierant, director of Northstar Infinity Works Ltd — [email protected] reaches him, and post reaches the registered office in the footer.
• Don't want letters? The letter's own link has a "stop writing to this company" button — one click, permanent. More on the whole mechanism: Why did I get a letter?

The evidence trail you can check yourself

Every filing event in PromptFiling is written into an append-only chain: each record carries a cryptographic fingerprint of the one before it, so history cannot be edited without breaking the chain visibly. The chain heads are signed, the signing key's public half is published at /api/audit/pubkey, and anyone — customer, lender, solicitor — can verify a chain at /api/audit/verify without an account. Filing certificates carry a QR code that resolves against this chain, which is why a PromptFiling certificate cannot be quietly forged: editing the PDF changes nothing, because the proof lives here.

How your data is treated

Company numbers, deadlines and filing history come from the public register. What you add is used only to do the job: your company authentication code is stored encrypted (AES-256-GCM, decrypted only at the moment of submission); your e-mail and figures live in our EU database, are never sold or shared beyond the processors named in the privacy notice, and are deleted on your instruction — statutory records (invoices, filed accounts) excepted, as the law requires. The authentication code never appears in logs, and our build process mechanically proves that on every release. We are an independent tool, not connected to Companies House or HMRC, and we never file anything without your explicit approval.

Found a vulnerability?

Write to [email protected]. We read every report, we answer, and we do not pursue good-faith researchers. Details in /.well-known/security.txt.