Security & verification
Got our letter and checking whether we're real?
Good instinct. Three checks that don't require trusting a word we say:
- Look us up on the government register: PromptFiling is a trading name of Northstar Infinity Works Ltd, company no. 17326480, England and Wales.
- Look your company's deadline up the same way, free, at find-and-update.company-information.service.gov.uk — our letter should match it exactly, because that is where it comes from.
- A person answers: PromptFiling is run by Adam Sierant, director of Northstar Infinity Works Ltd — hello@promptfiling.co.uk reaches him, and post reaches the registered office in the footer.
- Don't want letters? The letter's own link has a "stop writing to this company" button — one click, permanent. More on the whole mechanism: Why did I get a letter?
The evidence trail you can check yourself
Every filing event in PromptFiling is written into an append-only chain: each record carries a cryptographic fingerprint of the one before it, so history cannot be edited without breaking the chain visibly. The chain heads are signed, the signing key's public half is published at /api/audit/pubkey, and anyone — customer, lender, solicitor — can verify a chain at /api/audit/verify without an account. Filing certificates carry a QR code that resolves against this chain, which is why a PromptFiling certificate cannot be quietly forged: editing the PDF changes nothing, because the proof lives here.
How your data is treated
Company numbers, deadlines and filing history come from the public register. What you add is used only to do the job: your company authentication code is stored encrypted (AES-256-GCM, decrypted only at the moment of submission); your e-mail and figures live in our EU database, are never sold or shared beyond the processors named in the privacy notice, and are deleted on your instruction — statutory records (invoices, filed accounts) excepted, as the law requires. The authentication code never appears in logs, and our build process mechanically proves that on every release. We are an independent tool, not connected to Companies House or HMRC, and we never file anything without your explicit approval.
Post-quantum, stated precisely
Connections to this site negotiate hybrid post-quantum key agreement — X25519MLKEM768, combining a classical curve with ML-KEM (NIST FIPS 203) — between compatible browsers and our edge, and onward to our origin infrastructure. This protects today's traffic against "record now, decrypt later" attacks: a recording made now cannot be unlocked by a future quantum computer. Data at rest, including your authentication code, is encrypted with AES-256-GCM, which remains secure against known quantum attacks.
Stated honestly, because precision is the point: the signatures on our audit chain are classical (Ed25519) with a versioned key scheme ready to adopt post-quantum signatures (ML-DSA, FIPS 204) as the ecosystem matures — and no serious vendor should tell you they are "quantum-proof". Check the key agreement yourself, without asking us:
echo | openssl s_client -connect promptfiling.co.uk:443 -tls1_3 -groups X25519MLKEM768 2>/dev/null | grep Negotiated
# Negotiated TLS1.3 group: X25519MLKEM768 (OpenSSL 3.5+)Found a vulnerability?
Write to security@promptfiling.co.uk. We read every report, we answer, and we do not pursue good-faith researchers. Details in /.well-known/security.txt.