Privacy Policy

Mahoney Control (the “Platform”) is a cybersecurity and managed-services operations platform operated by Mahoney IT Group USA LLC (“Mahoney”, “we”, “us”), 200 East Las Olas Boulevard, 14th Floor, Fort Lauderdale, FL 33301, USA. For privacy questions contact legal@mahoney-it.com.

• Account & identity data — name, work email, organisation, role and authentication metadata for users of the Platform.
• Operational & security telemetry — device, incident, governance and posture data ingested from the systems a customer connects (e.g. Microsoft 365 / Defender, EDR, RMM, SIEM and cloud providers), to deliver the security and operations services.
• Billing data — plan, usage, invoices and the identifiers needed to process payments through our payment processors. We do not store full card numbers; card data is handled by the payment processor.
• Usage & audit logs — actions taken in the Platform, with timestamp, actor and (where relevant) IP address, kept for security and audit purposes.
• Module usage — which module of the Platform a user opened on which day, and whether they finished the product tour. No pages, clicks or times of day. Used only to suggest each user's next useful step in the Platform and in our product updates; never shared with third parties; deleted after 400 days.

We process data to provide, secure, support and bill the Platform; to detect and respond to security incidents; to meet legal and contractual obligations; and to improve the service. Processing is grounded in the contract with the customer (the Master Service Agreement) and our legitimate interest in operating a secure platform.

We share data only as needed with vetted providers that process it on our behalf:

• Stripe and Intuit (QuickBooks Payments / QuickBooks Online) — payment processing and invoicing.
• Supabase and Vercel — database, storage and application hosting.
• Microsoft — when a customer connects Microsoft 365 / Entra / Defender.
• Anthropic — AI analysis features, on the data the customer submits to them.

Each provider is bound by confidentiality and data-protection terms at least as protective as those we offer. Within the Mahoney IT Group, data may be shared among affiliates under common control solely to deliver and support the service.

When a customer connects QuickBooks, we use Intuit’s APIs only to create and reconcile invoices and to process payments the customer authorises. We access the minimum QuickBooks data needed for those functions, do not sell it, and retain it only as long as needed for billing and legal record-keeping. Disconnecting QuickBooks (in QuickBooks or via the Platform) revokes our access; see our disconnect page.

We keep data for as long as the account is active and as required to meet legal, tax and audit obligations, then delete or anonymise it. Audit and acceptance records (e.g. MSA acceptances) are retained for their evidentiary value.

We protect data with encryption in transit and at rest, strict role-based access control (default-deny row-level security), secret vaulting and audit logging. No system is perfectly secure, but we apply controls aligned to recognised frameworks (ISO 27001, SOC 2, NIST).

Each customer is recorded under a residency region (EU, US or Asia). Today that region determines how the customer is billed and reported, and it does not yet place their data in a separate regional database: the Platform runs one production database, and data is processed where our sub-processors operate. Per-region data storage is planned and not built, and we say so here rather than imply otherwise. The sub-processor list names every processor, what it processes and where.

Where data is transferred across borders, we rely on appropriate safeguards. We comply with applicable laws including the GDPR, the California Consumer Privacy Act (CCPA), and the Florida Information Protection Act (FIPA) / Florida Digital Bill of Rights (FDBR).

Subject to applicable law you may request access, correction, deletion or portability of your personal data, and may object to or restrict certain processing. For customer-account data we act on the instructions of the customer (the data controller). Contact legal@mahoney-it.com to exercise a right.

We may update this policy; material changes will be notified through the Platform or by email. Continued use after the effective date of an update constitutes acceptance.