Your clients' data, protected by design.

It is worth being specific, because "in the EU" can mean a great many things. Your firm's database — the matters, the documents and the user accounts — is in Ireland, in the AWS eu-west-1 region used by our managed database provider. The application that queries it runs in Amsterdam. Both inside the European Union; neither one in Spain.

That distinction matters and we are not hiding it: if your firm needs residency on Spanish soil, Mandato does not offer it today. What it does offer is European residency, with the database and the hosting contracted from providers who guarantee it contractually.

The whole chain stays in the EU, and that is the part worth examining closely in any vendor: the database in Ireland, the application in Amsterdam, transactional email in our sending provider's European region, and the WhatsApp integration through a German provider. Messaging is where competitors' European promises usually break, which is why we name it separately.

What does leave the European Economic Area is part of the AI processing, and it is identified one by one in the data processing agreement: the medium and high complexity models process in the United States under Standard Contractual Clauses and the EU-U.S. Data Privacy Framework. There is a European AI provider the routine tier can be routed to. One further distinction almost nobody draws: hosting in the EU and contracting with a European entity are not the same thing — our email provider operates in a European region but its contracting entity is American, so the transfer remains covered by Standard Contractual Clauses. That is how it appears in the DPA. There are no hidden sub-processors: each is listed with its role and its location.

The biggest risk in a multi-firm system isn't an outside intruder: it's one firm's data appearing, by mistake, on another firm's screen. Mandato prevents that at the deepest layer, the database itself, with row-level security.

Every row of data belongs to a firm, and no query can return another firm's rows. It isn't a check the application could forget to run: it's a rule of the database itself, enforced on every read and every write.

Mandato uses language models to analyse documents, draft replies, summarise meetings and classify email. It is worth knowing where each of those goes, because they do not all go to the same place.

Routine work — drafts, summaries, classification — is served by a light model. Medium and high complexity work, and document analysis, go to Anthropic's Claude models, which process in the United States under Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.

Any firm can turn on «EU-only» mode in its settings. With it on, the routine tier stops leaving for the United States and is served by a European provider on models hosted in the EU. We are deliberately precise about its scope: it moves the routine tier, not the whole of the processing. Medium and high complexity work stays on Claude, and telling you otherwise would be selling you a guarantee the product does not give.

Whichever model handles it, every AI query lands in the immutable audit log: which matter, which user, when.

The password on a Mandato account is not guarding a shopping list. From the first login it guards names, NIE and passport numbers, documents and matter detail covered by Ley 10/2010 and the GDPR. Which is why the floor is not the usual eight characters.

Sign-up requires at least ten characters, with an upper case, a lower case and a digit, and the form shows a strength meter and the live requirement list as you type — to push past the minimum, not to reward scraping over it. The rule lives in one place in the code and is enforced in the browser and on the server, so neither half can be relaxed without the other.

From there, each user reaches only their own firm's data and only what their role allows, and everything they do lands in the audit log.

When a sensitive piece of data is read, changed or shared, there's a record. The audit trail notes who took the action, on which matter and at what moment, and it can't be edited or deleted after the fact.

Artificial intelligence is no exception: every interaction with the AI is in that same log — who launched it, on which document and when — and your firm's data is not used to train models, neither ours nor the model provider's.

“Delete this client” is not an instruction a Spanish firm can simply carry out. Several statutes impose minimum retention periods on what that client generated, counting from the end of the relationship: ten years for the Ley 10/2010 due-diligence file (art. 25), and six for accounting and invoicing records (art. 66 LGT and art. 30 of the Commercial Code).

Mandato carries those periods as rules rather than as good intentions. Each firm sets its own general window — the professional-liability one — and the legal minimums can be raised but never taken below their floor.

When a deletion is requested for a client whose file is still inside a mandatory period, the correct answer is not to erase but to anonymise: strip the personal data, keep the record the law requires you to keep. The tool names which obligation is holding it and until when. A matter that is still open holds for as long as it stays open, for obvious reasons.

No serious provider promises an incident will never happen; what marks one out as serious is having a plan for when it does. Mandato maintains an incident-response process: detection, containment, scope assessment and notification where required.

If an incident affected personal data and were notifiable, the GDPR sets the timelines and the recipients, and we act accordingly. We'd rather describe the process than promise an invulnerability no one can guarantee.