Taxmo documentation

Complete product documentation for Taxmo: what is in each plan, the REST API reference, the HMRC Making Tax Digital and Open Banking integrations, and the platform architecture, security and UK GDPR position. Taxmo is a UK tax management platform for sole traders, freelancers, expats and small businesses, with a separate practice management plan for accounting firms.

Platform overview

Taxmo manages UK tax administration from a single dashboard. The core pieces are a VAT dashboard with all nine boxes calculated from your entries, professional invoicing with PDF export and recurring invoices, an AI assistant for UK tax questions, receipt scanning and email capture with data extraction from photos, PDFs and forwarded receipts, direct HMRC filing of VAT returns over Making Tax Digital, bank imports by Open Banking connection or CSV upload, and Self Assessment preparation with an AI review of the SA100.

For most sole traders and small businesses the documentation positions Taxmo as removing the need for a separate accountant on routine work. Making Tax Digital for Income Tax quarterly submission is documented as coming soon, not available.

Plans and tiers

There are four tiers and all of them include the core VAT dashboard. You can upgrade at any time with no long-term commitment. Current prices and entry limits are on the pricing section of taxmo.co.uk and are not repeated here, because they change.

REST API

The Taxmo REST API provides read access to your own tax and bookkeeping data and is available to Pro subscribers. The base URL is https://taxmo.co.uk/api/v1, all responses are JSON, all requests must use HTTPS, and authentication is an API key sent in the X-API-Key header. API keys are hashed with SHA-256 before storage and the raw key is shown once at creation.

Documented endpoints cover entries, profile, invoices, the VAT return for a given quarter and year, and an annual summary. The rate limit is 300 requests per 15-minute window, and the documentation asks integrators to cache responses, avoid polling the same resource more than once a minute, use the quarter and year query parameters to fetch only what they need, and handle a 429 response with exponential backoff.

Accountant practice features

The accountant plan is a separate practice management suite on top of everything in Pro, billed per active client. It covers a practice dashboard, client workspaces, staff roles, task and deadline tracking across all clients, a document request portal, practice invoicing, service time tracking, an AML and KYC compliance overview, and a set of AI tools including filing review, a tax auditor, a client assistant, a financial translator, a coach, a quote generator and smart notifications.

Beyond that it documents MTD VAT agent submission as on the roadmap, full AML and KYC aligned with the Money Laundering Regulations 2017, e-signed engagement letters, CT600 draft computations, payroll with payslip generation, trial balance with draft P&L and balance sheet, a suite of UK tax calculators, recurring tasks, an iCal deadline feed, a client risk dashboard, bulk email, WIP to invoice conversion, practice KPIs and an audit log.

Open Banking and bank imports

Two routes bring bank transactions in and they have different limits. Open Banking is on the paid plans, with a monthly transaction allowance on the middle tier and no cap on the top tier. CSV statement upload is available on every plan.

The Open Banking provider is PayBank2Bank, using its Account Information product. This is an on-demand importer, not a background sync, and the documentation is explicit that this is the design rather than a caveat. You are sent to the provider's hosted bank-selection page and authorise at your own bank's sign-in, so your banking credentials are never entered into Taxmo. The connection is read-only account information and cannot initiate a payment. Each import returns a recent window rather than your whole history, re-authorisation is required for every import rather than periodically, transactions land in a review queue with categorisation suggestions and are excluded from your figures until approved, and you can revoke access at your bank at any time independently of Taxmo.

CSV statement upload has no history limit. Layouts are detected automatically from their own column names for Barclays, HSBC, Lloyds, NatWest and RBS, Starling, Monzo and Revolut, with a generic column mapping that recognises the date, description, amount, credit and debit names statements commonly use. Single-signed-amount and split credit and debit layouts are both handled, and the date convention is applied per bank, including the year-first order Revolut exports.

Imported transactions are pending until approved and are not in your VAT figures until then. The pre-filing checklist blocks a VAT submission while an unreviewed batch exists, because filing with one would understate the return.

HMRC Making Tax Digital for VAT

VAT returns are submitted directly to HMRC over the Making Tax Digital API on the paid plans. The filing flow has six documented stages: authorise, obligations, prepare, check, declare and submit, then receipt.

One pass through HMRC's own sign-in grants Taxmo an OAuth token scoped to reading and writing VAT, and your Government Gateway credentials are never seen by Taxmo. Taxmo then reads your open VAT obligations from HMRC and takes the period key from HMRC's response, so a return cannot be filed against a period HMRC has not opened. All nine boxes are calculated from your approved entries, boxes 3 and 5 are derived, and value boxes are rounded to whole pounds as HMRC expects. The pre-filing checklist blocks on unreviewed bank imports, a missing VAT registration number, VAT amounts that disagree with the entry's rate, and draft invoices. HMRC requires an explicit finalised declaration and no return is transmitted without it. HMRC's confirmation is then stored against the period in your filing history, and VAT liabilities and payments can be read back from HMRC.

All nine boxes are supported. Boxes 2, 8 and 9 concern movements of goods between Northern Ireland and EU member states, so zero in all three is the normal case for a Great Britain business trading with the EU, which reports those movements as imports and exports instead. Tokens are stored encrypted and refreshed automatically; if the refresh chain breaks you are asked to reconnect rather than the connection failing silently. Fraud prevention headers such as Gov-Client-Connection-Method, Gov-Vendor-Version and Gov-Client-Public-IP are sent on every HMRC API call as required by HMRC's transaction monitoring specification. Agent submission on behalf of clients is not available.

Making Tax Digital for Income Tax, not yet live

Quarterly updates, End of Period Statements and Final Declarations are documented as coming soon and awaiting HMRC production API approval. Nothing in this area can be filed from Taxmo today.

When it is live the documented scope is a connection linked by National Insurance number, quarterly periodic summaries of income and expenses, annual adjustments before final submission, on-demand HMRC tax calculation triggers, final declarations, and automatic mapping of expenses to the expense categories HMRC recognises. Check GOV.UK for the qualifying income band and start date that apply to you.

Architecture, security and UK GDPR

The frontend is a React single-page application in TypeScript with Vite, TanStack Query, Tailwind CSS and shadcn/ui, with dark and light modes. The backend is Node.js with Express in TypeScript, a REST API with session-based authentication. The database is PostgreSQL on Neon with Drizzle ORM. Stripe handles subscription payments and card data never touches Taxmo servers. Anthropic Claude powers the AI assistant and receipt scanning, under a data processing agreement. PayBank2Bank provides Open Banking account information.

Security measures documented include HTTPS with TLS and HSTS, HMRC OAuth tokens encrypted with AES-256-GCM using a unique random initialisation vector and authentication tags, passwordless authentication by magic link or Google OAuth so no passwords are stored, HTTP-only secure cookies with a SameSite policy and server-side sessions, API keys hashed before storage, a standard set of security headers, rate limiting on both the API and authentication attempts, and input validation on VAT registration numbers, National Insurance numbers and VAT return values.

On UK GDPR and the Data Protection Act 2018, the documentation states data minimisation, a right of access through CSV and PDF export, a right to deletion through full account deletion in Settings, automated cleanup of expired sessions and stale data, cookie consent tracking, DataIQ B.V. trading as Taxmo as the data controller, and every processor named in the privacy policy and bound by a data processing agreement.

Common questions

Does Taxmo have an API?

Yes, a read-only REST API for Pro subscribers at https://taxmo.co.uk/api/v1. All responses are JSON, all requests must use HTTPS, and you authenticate with an API key in the X-API-Key header. Documented endpoints cover entries, profile, invoices, the VAT return for a given quarter and year, and an annual summary. There is no public write API.

What are the Taxmo API rate limits?

The API allows 300 requests per 15-minute window. The documentation recommends caching responses, not polling the same resource more than once a minute, and using the quarter and year query parameters to fetch only the data you need. Design your integration to handle a 429 Too Many Requests response with exponential backoff.

How does Taxmo connect to a UK bank account?

Through Open Banking, using PayBank2Bank's Account Information product. You authorise at your own bank's hosted sign-in, so your banking credentials are never entered into Taxmo, and the connection is read-only and cannot initiate a payment. It is an on-demand importer rather than a background sync: you re-authorise for every import and each import returns a recent window rather than your full history, so CSV statement upload is the route for older periods.

How does Taxmo file a VAT return to HMRC?

Over HMRC's Making Tax Digital API in six stages. You authorise once at HMRC's own sign-in, granting an OAuth token scoped to reading and writing VAT. Taxmo reads your open obligations from HMRC and uses HMRC's own period key, calculates all nine boxes from your approved entries, runs a pre-filing checklist that blocks on unreviewed bank imports, a missing VAT registration number, mismatched VAT amounts and draft invoices, requires HMRC's explicit finalised declaration, and stores HMRC's receipt against the period.

Which VAT return boxes does Taxmo support?

All nine. Box 1 is VAT due on sales and other outputs, box 2 is VAT due on acquisitions of goods made in Northern Ireland from EU member states, box 3 is total VAT due and is calculated, box 4 is VAT reclaimed on purchases and other inputs, box 5 is the net VAT to pay or reclaim and is calculated, box 6 and box 7 are total sales and total purchases excluding VAT, and boxes 8 and 9 cover goods dispatched from and acquired into Northern Ireland from EU member states. For a Great Britain business trading with the EU, boxes 2, 8 and 9 are normally zero because those movements are reported as imports and exports instead.

Can Taxmo file Making Tax Digital for Income Tax?

Not yet. Quarterly updates, End of Period Statements and Final Declarations are documented as coming soon and awaiting HMRC production API approval, so nothing in that area can be submitted from Taxmo today. Your records are kept in the form it will need, including quarterly digital records. Check GOV.UK for the qualifying income band and start date that apply to you.

How is my data secured, and does Taxmo comply with UK GDPR?

Traffic runs over HTTPS with TLS and HSTS, HMRC OAuth tokens are encrypted with AES-256-GCM, authentication is passwordless by magic link or Google OAuth so no passwords are stored, sessions use HTTP-only secure cookies stored server-side, and API keys are hashed before storage. On UK GDPR and the Data Protection Act 2018 the documentation states data minimisation, export of all your data as CSV and PDF, full account deletion from Settings, cookie consent tracking, DataIQ B.V. trading as Taxmo as the data controller, and every processor named in the privacy policy and bound by a data processing agreement.