How we look after your company's information.

Where your data lives

On Amazon (Amazon Web Services), North Virginia region, in the United States. MyWacc's own artificial-intelligence model, which reads your documents, runs in Amazon's Oregon region. That is why your data is processed in the United States, as the privacy policy and the data contracts say.

Encryption

• In transit: between your browser and MyWacc, and between the distribution network and our servers, everything goes over HTTPS. Unencrypted traffic is redirected to HTTPS, and the servers only accept connections coming from Amazon's distribution network.
• At rest: the database and files are stored encrypted with an Amazon key that is rotated once a year. New disks are encrypted by default and files cannot be left public by mistake.

The SII password

• It is stored encrypted in a secrets-management service; the MyWacc team does not see it and does not need it to operate. It does not end up in documents, messages or logs and is not handed to anyone.
• Every time it is used, a record is kept.
• It is revoked from the app with “Disconnect the SII” or by changing it at the SII. On revocation all access stops, and when the service ends we delete it.
• If you prefer not to give it, you can upload your tax folder: it asks for no password.

Backups

The database is backed up with 14 days of retention, has deletion protection and its backups are automatically copied to another region (Oregon). The main server's disk is backed up daily, also for 14 days.

Threat detection and firewall

• Amazon's threat detection, vulnerability scanning and configuration assessment, enabled in both regions. Serious findings and permission changes reach us by email.
• Web firewall with Amazon-managed rules. Today it is in monitoring mode: it logs anything suspicious, and we switch it to blocking once we confirm it does not affect normal use.
• The application servers are not open to the rest of the internet: they only receive traffic from Amazon's distribution network.

Certificate verification

When our servers connect to the SII, Previred, the Labor Directorate, the Treasury, Flow, WhatsApp, email or Amazon, they check the other side's certificate, to be sure they are talking to who they should. We reviewed this on 31 October 2026.

Who gets in and what is recorded

• Minimum permissions per role. The infrastructure administration account requires two-factor authentication.
• Automated tools work with a limited role that cannot create users or switch off audit logs.
• We record Amazon account activity (with integrity validation), distribution-network access, firewall decisions and network traffic for 30 days.
• Each company's data is kept separate. We never cross information between companies.

Who else touches the data

We use few providers, and we list them all with what they see and where they are: Amazon, Google (email), Flow (payments) and WhatsApp (messaging, only if you link it). The model that reads your data is our own and runs on our own machines; your data does not go out to third-party AI providers. The full list is in the annex of the data processing contract and of the agreement for investors (both in Spanish). We give 15 days' notice of any change.

If there is a breach

If something affects your data, we tell you without delay and at the latest within 48 hours of learning of it, to your company's contact person (not a general mailbox), with what happened, which data and what we recommend. We have a written incident management plan and keep a record of each one.

Your rights (Law 21.719)

You can ask for access, rectification, erasure, objection, blocking and portability of your data. Write to contact@mywacc.com. We reply within 30 calendar days, extendable once, and a reasoned temporary block within 2 business days. If the data belongs to a company for which we are the processor, we pass your request on to it and help it respond. More detail in How we protect your data.

If a figure is missing, we say so

MyWacc does not make things up. If a figure could not be read, did not arrive or is old, it is marked as pending and we ask you for it, instead of filling it with an assumption. When something is an estimate, it says so and where it comes from. When we use an assumption, we show it so you can confirm or correct it. And if we make a mistake, we tell you first. What happens if there is a mistake (Spanish).

Roadmap

Already written. We have eleven security documents, version 1.0, which we hand to anyone who asks at contact@mywacc.com:

1. Appointment of the Information Security and Personal Data Officer
2. Information Security and Cybersecurity Policy
3. Security incident management plan
4. Business continuity and disaster recovery plan
5. Backup and restore policy
6. Access control and credential management policy
7. Vulnerability and patch management policy
8. Secure development and change management policy
9. Supplier management policy
10. Cybersecurity risk matrix
11. Asset inventory

What comes next. A security assessment by an independent third party, once client volume justifies it, and ISO 27001 certification, which is our goal for 2027. We do not give an exact date as long as it is not a promise we can keep.

Security contact

To report a security problem, ask for the documents or ask a security question: contact@mywacc.com. If you find a flaw, tell us before publishing it: we fix it and we thank you.