Security and data
We work with data from the SII, Previred and your bank. Here, plainly, is where it lives, how we protect it, what is still missing and what you do if something goes wrong. We only state what exists today.
On Amazon (Amazon Web Services), North Virginia region, in the United States. MyWacc's own artificial-intelligence model, which reads your documents, runs in Amazon's Oregon region. That is why your data is processed in the United States, as the privacy policy and the data contracts say.
The database is backed up with 14 days of retention, has deletion protection and its backups are automatically copied to another region (Oregon). The main server's disk is backed up daily, also for 14 days.
When our servers connect to the SII, Previred, the Labor Directorate, the Treasury, Flow, WhatsApp, email or Amazon, they check the other side's certificate, to be sure they are talking to who they should. We reviewed this on 31 October 2026.
We use few providers, and we list them all with what they see and where they are: Amazon, Google (email), Flow (payments) and WhatsApp (messaging, only if you link it). The model that reads your data is our own and runs on our own machines; your data does not go out to third-party AI providers. The full list is in the annex of the data processing contract and of the agreement for investors (both in Spanish). We give 15 days' notice of any change.
We keep an internal register of what data we process, for what purpose, on what legal basis and for how long. There are currently 11 processing activities, covering every table where we hold anything of yours. An automated check warns us if a new table appears unclassified, so no data is processed outside the register.
If something affects your data, we tell you without delay and at the latest within 48 hours of learning of it, to your company's contact person (not a general mailbox), with what happened, which data and what we recommend. We have a written incident management plan and keep a record of each one.
You can ask for access, rectification, erasure, objection, blocking and portability of your data. Write to contact@mywacc.com. We reply within 30 calendar days, extendable once, and a reasoned temporary block within 2 business days. If the data belongs to a company for which we are the processor, we pass your request on to it and help it respond.
For access or portability, the file is downloaded through a link of our own that lasts 7 days and allows 5 downloads. It does not include credentials or secrets.
Illustrative example · Example Co. SpA
Hello,
We received your access request on 14 October and it is resolved within the article 11 deadline. We have prepared a file with everything we hold on Example Co. SpA: the tax documents we read, the return calculations we prepared, the payroll we processed, and the log of every time we signed in to the tax authority with your credentials.
The file does not include your tax credentials or any secret: those are not handed over, not even to you by email. The link lasts 7 days and allows 5 downloads.
We process that data to provide the service you signed up for. If you want to object to any of the processing activities, or ask us to delete something, reply to this email and we will handle it.
Tino (MyWacc), an AI that can make mistakes.
The version in force is v2.2. It was published on 26 October 2026 and we notified the users who were already with us. If anything in that version seems wrong to you, you can object until 25 November 2026 by writing to contact@mywacc.com.
Read privacy policy v2.2 · Terms of use
MyWacc does not make things up. If a figure could not be read, did not arrive or is old, it is marked as pending and we ask you for it, instead of filling it with an assumption. When something is an estimate, it says so and where it comes from. When we use an assumption, we show it so you can confirm or correct it. And if we make a mistake, we tell you first. What happens if there is a mistake (Spanish).
Already written. We have eleven security documents, version 1.0, which we hand to anyone who asks at contact@mywacc.com:
What comes next. A security assessment by an independent third party, once client volume justifies it, and ISO 27001 certification, which is our goal for 2027. We do not give an exact date as long as it is not a promise we can keep.
To report a security problem, ask for the documents or ask a security question: contact@mywacc.com. If you find a flaw, tell us before publishing it: we fix it and we thank you.
For accountants and companies: the data processing contract (PDF). For funds and creditors: the data processing agreement (PDF) and the consent clause (PDF). Spanish originals.
Questions? Write to us at contact@mywacc.com
