Single-tenant isolation
Each firm runs its own deployment of the platform on its own subdomain, with its own application services and its own session cookies. There is no shared tenancy layer to get wrong, because there is no shared tenancy.
Security & compliance
Your clients' tax affairs, kept on your own instance
Personal tax data is about as sensitive as client data gets. The design decision underneath Jerenta is that firms are not mixed together in the first place.
A database per firm
Your instance has its own PostgreSQL database with its own credentials. No query in the system can reach another firm's data, because the connection does not go there.
Documents encrypted at rest
Uploaded documents are encrypted with AES-GCM before they are stored, using a key held for your instance alone. The store never holds a readable copy of a client's payslip or bank statement.
Malware scanning on upload
Uploads can be scanned by ClamAV before they are accepted. With scanning switched on and the scanner unreachable, the upload is refused rather than let through — an unscanned file should never enter the store quietly.
Role-based access
Clients see their own return and nothing else. Preparers, senior reviewers, administrators and operations staff each get the access their job needs. Accounts are invited into the portal, and self-registration can be switched off so an invitation is the only way an account is created.
Audit log
Actions that matter are recorded with who did them and when, and case status history is kept alongside the return — including who approved it before it was filed.
UK and EU data residency
Instances are hosted on OVHcloud in the UK and EU. Your clients' data does not leave that footprint in the course of running the platform.
Backups
Backup arrangements for your database and document store are agreed with you during onboarding, and your instance's encryption key is recorded at the same time — without it an encrypted backup cannot be restored.
Data protection roles
Your firm is the data controller for your clients' personal data: it is your client relationship, and you decide what is collected and why. Jerenta is the data processor, handling that data on your instructions in order to run the platform for you.
That split is the one the UK GDPR and the Data Protection (Jersey) Law 2018 expect, and it is the basis of the processing terms we sign with each firm. Your firm remains the registered entity with the Jersey Office of the Information Commissioner, and we support you with the technical detail your registration and any client due diligence needs.
Security questions from a prospective client, or from your own compliance team, are welcome before you commit to anything — write to support@jerenta.com.
Bring your compliance questions
We would rather answer them before you buy than after.