Book a demo

Security and data

Your firm’s data stays protected and under control.

Where it is, who can see it, how the AI works and what we do if something goes wrong.

Prisma’s Team and permissions screen with demo data: for each role in the firm, from owner to contributor, what they can do with clients, mail and WhatsApp. Changes are shown before saving.
  • Each firm sees only its own data
  • Permissions, item by item
  • Mail and WhatsApp too
  • A role for every person
  • What changes, before saving
  • Changes are logged

Demo data

Firm security, in Prisma

A firm’s data is too important to leave to chance.

Balance sheets, tax returns, payslips and identity documents all pass through a firm. And the risk is almost never a movie-style attack: it is the person who left and still has their mailbox connected, the Drive file open to anyone with the link, the invitation never accepted that is still out there.

That is why Prisma has Firm security. It checks the firm on its own, usually every week, and tells you what to fix, in what order and who should do it.

Prisma’s Firm security screen with demo data: Monday’s latest check, two serious issues and three to fix, the list of problems, the drives read and what the check cannot see.
  • Checks on its own, usually every week
  • Serious things first
  • People who left but are still connected
  • Files open to anyone
  • Fix it, and it checks again
  • Google Drive and OneDrive too
  • It tells you what it can’t see, too

Demo data

  1. 1

    It looks

    It reads Prisma and the connected drives: who signs in and how, who has left the firm, what is shared and with whom, links still open, the processing register.

  2. 2

    It tells you what matters

    Serious things first, then the rest. For each one, why it matters and what could happen.

  3. 3

    It tells you how, and who

    The steps to fix it, each with who does it: you, the person, or whoever owns the file. Then it reads again, and marks “all good” only what it has re-read.

The owner and partners can see it. Changes are made by the firm, with its confirmation: Prisma does not change anything on its own. And it does not promise a “secure” firm: it shows you what it sees, what to fix and what stays out of its view.

See it on your firm

The short answer.

  • Each firm sees only its own data.

    One firm’s information is kept separate from every other firm’s. Access depends on the user and their assigned role.

  • Protected in transit and at rest.

    Encrypted connections and the cloud infrastructure’s protections. Passwords and tokens for email, certified email and cloud connections are encrypted with a key stored separately from the database.

  • Important operations are logged.

    Permission changes, signature requests, archive moves and AI use produce logs that show what happened and who was involved.

  • Providers chosen and documented.

    We use specialised providers for cloud, AI and payments. Roles, processing locations and safeguards are in the privacy documents.

Where the data is

Different places, all declared.

  • Documents

    Stored in Italy, in the Milan area.

  • Databases

    Hosted in Switzerland, recognised by the European Union as providing adequate protection.

  • Cloud services

    The main application processing takes place in Belgium and Milan.

  • AI features

    Only what is needed goes to the provider. Data does not train the models, and processing is restricted in code to locations in the European Union. The exception is the phone voice agent, if the firm turns it on: its provider operates in the United States and may use calls to improve its own service.

Antivirus on incoming files

How we check incoming files.

Since 19 October 2026, files arriving through the channels listed below go through ClamAV, in our own service in Milan: the file is not sent to other providers and the virus list updates every two hours.

  • Clean

    The file goes ahead and every feature can use it, AI included.

  • Infected

    The file is quarantined and never reaches the AI.

  • Not checked

    Password-protected files, files over 50 MB, or the service is unavailable. The file is kept but the AI does not read it: open it with care.

Channels covered. Attachments saved from mail (Gmail, certified email and IMAP), client portal, upload links and scanner, WhatsApp and Telegram, files to and from Google Drive and OneDrive, Mastro Sync, e-signature, identity documents and anti-money laundering, accounting imports and F24, the firm’s archive.

What it cannot do. It recognises known viruses, does not open password-protected files and does not check links: it reduces the risk, it does not remove it. Does a file look suspicious? Write to hello@mastro.tax.

When AI comes in

It assists the work. It does not remove responsibility.

  • Defined permissionsOperational features are enabled for tasks and users agreed with the firm.
  • Doubts go to reviewWhen data is missing or judgement is needed, the case stops and goes to the professional.
  • Traceable activityRelevant operations are logged so the work done can be checked.

If something goes wrong

There is a process, not a vague promise.

  • We monitor services and access.Anomalous events are analysed and access can be revoked.
  • We protect continuity.The infrastructure’s backups and recovery tools reduce the risk of data loss.
  • We handle incidents.If an event involves personal data, we assess the impact and follow the GDPR notification obligations.
  • The firm stays in control.It manages users and roles, asks for support, exercises privacy rights and obtains the processing documentation.

Common questions.

Does Mastro use the firm’s data to train AI models?

No, with one exception. For the platform’s AI features, based on Google Gemini, the applicable agreements exclude using the data to train models. The phone voice agent is off until the firm turns it on: its provider’s contract (Vapi) allows it to use calls to improve its own service.

Can the AI act without oversight?

Features are enabled with defined permissions and rules. Uncertain cases go to review and professional decisions stay with the firm.

Can different firms’ data get mixed?

No. Access is limited to the firm and its authorised users. The checks are enforced both in the application and in the database.

Where can I find the legal details and the list of providers?

In the Privacy Policy, the DPA and the privacy dossier. For specific questions you can write to hello@mastro.tax.

Documents and contacts.

This page helps you find your way, but it does not replace the contractual and privacy documentation.

Privacy PolicyDPAPrivacy dossierWrite to hello@mastro.tax

The certifications of our cloud and payment providers are not certifications held by Mastro. The current list of providers and the applicable terms are in the privacy and contractual documentation.