Trust and security
M.A. Whately is an Irish firm of Chartered Certified Accountants and Registered Auditors, trusted with clients' figures for over 30 years. The Suite is built to the same standard: your data stays in Ireland, it is encrypted on the way and at rest, every business is walled off from every other, and nothing is filed or sent without a person approving it. Every claim on this page can be checked.
From suite.mawhately.ie/trust. Last reviewed 6 October 2026. Questions: info@mawhately.ie, 041 685 3162.
Where your data lives
The Suite uses a small number of established providers. Each works under a written data processing agreement with the EU standard contractual clauses, and each is listed in ours. Some are US companies whose support staff may access systems from outside the EU under those safeguards.
Your requests, answers, uploaded files, bills, records and settings. Encrypted in transit and at rest.
Ireland (EU)Runs the Suite's server code in Dublin. Public pages are delivered from a global network so they load quickly; they hold no client data.
Dublin (EU)Sends requests, reminders and sign-in emails, from the EU (Ireland) sending region.
Ireland (EU)Only when a business uses AI to read a photographed bill or uses the Concierge assistant. Anthropic does not use this data to train its models. It may process requests outside the EU; the safeguards for that transfer are set out in our data processing agreement.
Only if usedHow it is protected
Row level security in the database keeps every business's records separate, and automated tests check that it holds. M.A. Whately cannot open a client's records unless that business adds the firm.
Sign-in is by invitation and a one-time link or code that works once and expires in an hour. Only people a business invites can join it.
Links sent to your customers and staff are long random keys. Each upload uses its own signed link that expires after 2 hours.
Account actions such as people added or removed, role changes, exports and deletions go to an audit log that cannot be edited. Owners can read it at any time.
Owners can download all of their business's data at any time. Finished records are deleted automatically after the period you set; closing an account removes its files and records.
Keys that can reach all data never leave the server. Connections to Xero are stored encrypted. Pages are served with strict browser security headers.
Encryption
Three layers, each labelled with how it is known: checked live against the running Suite, stated by the provider that runs it, or written into the Suite's own code.
Between your browser and the Suite
Where records and files are stored
Read on each provider's security page, 6 Oct 2026: Supabase, Vercel, Resend.
What M.A. Whately built on top
Check it yourself
You do not have to take our word for any of this. These free, independent scanners test the live Suite from the outside. The results below are the ones we obtained, with the date; press a link to run the test again today.
TLS 1.2 and 1.3 only, forward secrecy with every browser the test simulates, a 2048-bit certificate, and no known protocol weaknesses (Heartbleed, POODLE, BEAST).
Tested 6 Oct 2026, 15:35 UTC Run the SSL Labs test →Score 80 out of 100. The one test not passed: the content security policy allows inline scripts, because each Suite tool is a single self-contained file that also works offline. Scripts can still load only from the Suite itself and, at pinned versions, from the public code network cdn.jsdelivr.net.
Tested 6 Oct 2026, 15:21 UTC Run the Observatory scan →Suite emails are sent from send.mawhately.ie through the EU (Ireland) sending region, signed with a DKIM key published at resend._domainkey.mawhately.ie, and covered by an SPF record. Receiving mail servers can check that a Suite email is genuine.
DNS checked 6 Oct 2026 Look up the DKIM record →curl -sI https://suite.mawhately.ieAI, used carefully
AI saves real time on reading bills and answering questions. These are the rules it works under in the Suite.
A photo of a bill, or a question such as "which invoices are overdue?".
The answer is checked against your own records and Irish rules, and anything unclear is marked for you.
Nothing is sent to Xero, posted or emailed to a customer until a person says so.
If you leave
Leaving should be as easy as joining. Your data is yours, in a format you can open, and it goes when you go.
An owner or admin presses Download all data in Settings. The file holds requests, answers, contacts, templates, people, the timeline and your tools' data, with links to every file that work for 24 hours.
Email info@mawhately.ie or ring 041 685 3162 and ask for the account to be closed.
Closing the account deletes its files, logo and every record from the live system, and the deletion is written to the audit log.
Finished requests are deleted with their files after the period you set, from 3 months to 7 years, and you can delete any request yourself at any time.
GDPR and your rights
For the records your business keeps in the Suite, your business is the controller and M.A. Whately is the processor, acting only on your instructions. Our data processing agreement sets this out in full, in line with Article 28 of the GDPR.
The agreement commits M.A. Whately to tell you about any personal data breach affecting your data within 48 hours, and to help you with any report to the Data Protection Commission.
Access, correction, deletion and a copy of data can be handled from the Suite itself, and we help where they cannot.
The providers above are the full list. We tell business owners in advance before adding or replacing one.
Contact us first and we will put it right. You can also contact the Data Protection Commission at dataprotection.ie.
For your IT or compliance team
| Provider | What it does | Where | Provider's own security statements | Links |
|---|---|---|---|---|
| Supabase, Inc. | Database, sign-in, file storage | AWS West EU (Ireland) | SOC 2 Type 2 compliant, ISO 27001 certified, AES-256 at rest | Security · DPA |
| Vercel Inc. | Application server, web pages | Dublin (functions); global network for public pages | SOC 2 Type 2 attestation, ISO 27001 certified, certified under the EU-US Data Privacy Framework, AES-256 at rest | Security · DPA |
| Resend | Email sending | EU (Ireland) sending region; account data in the US | SOC 2 Type II, transfers under the standard contractual clauses and the EU-US Data Privacy Framework, AES-256 at rest | Security · DPA |
| Anthropic, PBC | AI reading of photos and scans, Concierge (only when used) | May process outside the EU | Commercial Terms: may not train models on customer content | Trust Center · Terms |
Certifications belong to each provider, not to M.A. Whately; the wording is the provider's, from the pages linked. Ask for our data processing agreement for the full list with transfer safeguards.
Responsible disclosure
Our contact details are also published in the standard machine-readable form at /.well-known/security.txt.
Questions about your data? Email info@mawhately.ie or call 041 685 3162 (Monday to Friday, 8.30am to 5pm). Read the firm's privacy policy. M.A. Whately & Co. Unlimited Company, CRO 466004, Greenville, Jervis Street, Ardee, Co. Louth, A92 KH36.
Last reviewed 6 October 2026. Scan results are dated; provider statements were read on the providers' own pages that day.