A parliamentary inquiry into the leaking of more than a million documents detailing MPs’ expenses is focusing on the role of The Stationery Office (TSO), The Times has learnt.

Palace of Westminster officials have assured senior MPs that the documents were never kept as a complete digital file in the House of Commons.

But TSO, the privatised publisher of official documents, insists that an internal audit has established that there has been no breach of its own security.

John Wick, the security consultant who brokered the sale of the information, has told The Times that he is not the ultimate source of the leak.

The Speaker, Michael Martin, called in Scotland Yard but police decided against launching a criminal investigation because there was likely to be a “public interest defence”.

Depending on how the information was removed, it is possible that a potential breach of the Computer Misuse Act or the Data Protection Act may be discovered. Jack Straw, the Justice Secretary, has told MPs that the Information Commissioner was investigating the data-protection implications of the leak.

Commons authorities have now confirmed to The Times that their own inquiry is under way, headed by Robert Rogers, Clerk of Legislation. Attention has turned to a secure printing plant owned by TSO, a company born from the sale of Her Majesty’s Stationery Office in 1996.

The work of preparing the information for publication was undertaken by the Commons Department of Resources and by TSO under what MPs were told were “secure conditions”.

More than 1.2 million claims and receipts were transferred to the TSO Parliamentary Press depot in Southwark, London, in July 2008 after the High Court ruled they must be made public.

Approximately 800,000 documents are understood to have been paper copies in need of scanning. All were to have been edited. Sources said the inquiry had been advised by experts to concentrate on this process at TSO. Senior MPs are understood to have been told by the Commons Data Protection and Freedom of Information office that the leak could not have come from Westminster.

The Information Commissioner’s team has been in touch with Commons authorities since the former Home Secretary Jacqui Smith’s expenses were leaked and is awaiting the results of the parliamentary investigation before deciding whether the Data Protection Act has been broken.

A senior parliamentarian said he suspected the leak of all the documents was “an inside job” but Commons IT staff had persuaded him otherwise. “What changed my mind was an assurance from senior officials of the House that the collected data simply didn’t exist anywhere inside the House as a complete file,” he said. “Any particular official at the House dealing with it only had access to a small bit of it at a time. Nobody had access to the whole thing. The Fees Office was largely a paper-based system but to the extent that things were computerised, and they were a bit, different allowances were dealt with by different people, different years were separated from each other and no one within the team would have had access to all the information. It only existed in a consolidated format at TSO.”

Another source, close to the House of Commons Commission, said attention had initially been paid to TSO rather than the Commons. “There are only so many places that the disk can have come from. Bits of the Fees Office had bits of the information. But they did not have all the jigsaw.”

Mr Rogers, a career Palace of Westminster civil servant, was described by one MP as “a wily old devil” with some experience of mole-hunting.

The information was edited twice, adding to opportunities for a security lapse. In November 2008, further redactions were made on the advice of fraud experts and the Security Service.

“The first round of redaction was knocking out home addresses, telephone numbers, credit card and bank account numbers and the identity of anybody who had access to an MP’s home, like for example a cleaner,” the source said.

“The second round of redactions took into account two pieces of advice in October 2008, one from experts in credit card fraud who said that their advice was that receipts which showed the exact time and location of a transaction and the last four numbers of a debit or credit card would be enough information for a sophisticated credit card fraudster to bust the retailer’s IT security and perpetrate credit card fraud. So whereas the original receipt may have said, ‘Sainsbury’s, Southampton branch, Date: 28 October, Time: 3.36pm, Quantity: £13.46’, the second round of redaction knocked out the fact that it was the Southampton branch of Sainsbury’s and that the transaction took place at 3.36. But left in was the fact that it was Sainsbury’s and left in was the date.

“The second piece of advice we took on board was on the advice of MI5 which was that any information betraying an MP’s pattern of movement should be redacted.”

TSO said: “We have conducted a thorough internal investigation with the help of an independent auditor and have found absolutely no trace of a breach in our security. TSO has an impeccable record for security and we will not hesitate to take the appropriate action should anyone attempt to damage our reputation with unfounded allegations.”

A spokesman for the Commons refused to answer questions on the collation and movement of the data.

The Unite trade union has complained to the Information Commissioner that its members in the Commons may have had the security of their private details breached.

Times Recommends

• Postmen: We bind the nation together
• Tewkesbury: when the memories flood back
• Cast Offs actress: I’m happy that my face fits