Data processing

Who is the controller of what

A conveyancing transaction has two firms and at least two clients in it, so “who is controller of what” has a longer answer here than in most software. It is worth being exact, because your firm’s answer to its own DPIA depends on it.

Subject matter, duration, nature and purpose

Article 28(3) requires these to be set out. They are the same for every firm, so they are published here rather than negotiated one at a time.

Our commitments as your processor

These are the Article 28(3) obligations, in plain terms. We will:

• process only on your documented instructions — your use of the product is the instruction, plus anything you tell us in writing — unless the law requires otherwise, in which case we will tell you first if we are allowed to;
• keep it confidential, and make sure anyone we let near it is under a duty of confidence;
• apply the security measures in section 7, and not weaken them;
• use sub-processors only as set out in section 5, under written terms no less protective than these, and remain fully liable to you for what they do;
• help you respond to data subjects (section 8);
• help you with your security obligations, DPIAs and prior consultation (section 9), and with breach notification (section 10);
• delete or return everything at the end, at your choice (section 11);
• give you the information you need to demonstrate compliance, and submit to audit as described in section 12;
• tell you if we think an instruction of yours breaches data protection law.

We do not use your data to develop the product, to build any dataset, or to train any model. MatterLink has no artificial intelligence features and no client data is sent to any AI model or provider. If that were ever to change, we would tell every firm in advance, explain exactly what would be processed and where, and give you the option to decline. We would not turn it on quietly.

Sub-processors

This is the list firms’ compliance questionnaires ask for by name. It is short on purpose — every supplier added here is another party with a route to your clients’ data.

On US-incorporated suppliers. Supabase and Vercel are United States companies operating UK infrastructure. Your clients’ data is stored and processed in the UK. In the limited circumstances where a supplier’s support staff outside the UK could access data — for instance during a platform incident — that access is governed by the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, supported by a transfer risk assessment. We would rather set this out than let you discover it in a supplier’s own terms.

Changing this list

We will give you at least 30 days’ notice before adding or replacing a sub-processor, by email to your firm’s administrator. If you reasonably object on data protection grounds, tell us within that period and we will work with you to find a solution; if we cannot, you may terminate the affected part of the service without penalty and we will refund any fees for the period after termination.

To be added to the notification list, email dataprotection@matterlink.co.uk.

Where processing happens

Your clients’ data is held in the United Kingdom. The database and all stored files are in AWS’s London region (eu-west-2), and the application runs in the London region of our hosting provider. Data in transit is protected with TLS; data at rest is encrypted with AES-256.

There is no routine transfer of personal data outside the UK. Any exception — support access, or a supplier change — is covered by section 5.

Security measures

What follows is split into what is in place today and what is not yet. A security page that overstates the position is worse than a short one, and a firm that later discovers a claim was aspirational is right never to use the product again.

In place today

• Separation between firms is enforced by the database, not by the screens. MatterLink uses PostgreSQL row-level security, so the rules about who can see what are applied at the data layer. A bug in the interface cannot expose another firm’s data, because the database will not return it.
• Internal notes are structurally out of reach. They sit in a separate table that the other side’s access rules cannot reach — a boundary in the schema, not a hidden field on a shared record.
• Documents are private by default. A document you upload is visible only to your firm until you take an explicit, logged decision to share it.
• Stored files are not publicly reachable. The storage bucket carries no public access rules at all. Every file is served through our own servers after an authorisation check, using short-lived links.
• The client view cannot reach anything it should not. It is served by a single dedicated database function returning only the fields a client should see, with no route to internal notes, documents, or the other side. That is a property of how it is built, not a setting someone could get wrong. Client views are excluded from search engine indexing.
• Changes are recorded — who made them, which firm and which side they act for, what changed and when — and the actor’s side is re-derived on the server every time, so a stale or tampered browser session cannot claim to be acting for the other side.
• Cross-firm access is tested, not only designed. We maintain an automated test suite that attempts document access across firm boundaries from every angle and fails if any of it succeeds. It currently covers document access with 14 assertions; extending it to the remaining core tables is the next item below.
• Passwords are never stored in readable form, and no member of our team can retrieve one.
• No AI processing of any kind, as set out in section 3.

Not yet in place

These are being worked through in a documented order. If any of them is a condition of your firm proceeding, ask us where it has got to and we will tell you honestly.

• Multi-factor authentication for user accounts.
• Automated cross-firm access tests covering the remaining core tables, beyond documents.
• An append-only audit trail that no user or administrator can alter.
• Malware scanning of uploaded files.
• Point-in-time recovery with a tested, evidenced restore.
• Independent penetration testing, and Cyber Essentials certification.
• Rate limiting on authentication and token lookup endpoints.
• Session visibility and self-service revocation.

Helping you answer data subject requests

If your client asks you for a copy of their data, or asks you to correct or delete it, that request is yours to answer — you are the controller. We help by:

• passing on to you, without delay, any request we receive that appears to relate to your firm’s data, and not responding to it ourselves;
• giving you the technical means to find, export, correct and delete what you hold in MatterLink;
• doing the search ourselves at no charge where the product does not yet let you do it, within the timescale you need to meet your own one-month deadline — tell us early rather than at day 25.

Requests come to dataprotection@matterlink.co.uk.

Helping you with DPIAs and your own assessments

We will give you the technical detail your firm needs to complete its own data protection impact assessment, so that you are not reverse-engineering it from a website — including the data flows, the security measures in section 7 with their current status, the sub-processor detail in section 5, and answers to the Law Society of Scotland’s cloud vendor questions. Ask at dataprotection@matterlink.co.uk and we will send what we have. Where we do not yet have something, we will say so rather than improvise.

If there is a personal data breach

We will tell you within 24 hours of becoming aware of any personal data breach affecting your data — well inside the 72 hours you have to notify the ICO. We will tell you what we know, what we do not yet know, what we are doing about it, and what we recommend you do. We will keep telling you as we learn more, rather than waiting until we have a complete picture.

The decision about whether to notify the ICO or your clients is yours as controller. We will give you what you need to make it and to document it, and we will not make any public statement about an incident affecting your firm without talking to you first, unless the law requires us to.

Report anything you think might be an incident to security@matterlink.co.uk. That address is monitored ahead of everything else.

Return and deletion

Your data does not become ours by your leaving. When your agreement ends, or at any point on your written instruction:

• we make your transaction records and documents available for export in a usable format;
• we keep them available for 30 days so you have a real opportunity to retrieve them;
• after that we delete or return them as you have instructed, other than anything we are legally required to keep — and if that applies to anything, we will tell you what and why.

Backups are honest about their limits. Deleting something removes it from the live system immediately, but copies persist in routine backups until those backups age out on their normal cycle. Backups are encrypted, access-controlled, and never used to repopulate deleted data. We say this because it is true of every system of this kind and most providers leave it unsaid.

Audit and evidence

You have the right to satisfy yourself that we are doing what this page says. In practice that means: we answer your security questionnaire in writing; we send you the current version of the measures in section 7 with their real status; and we send you third-party evidence — a penetration test summary, a certification — as and when we have it. If that is not enough for your firm, you may audit us once a year on reasonable notice, at your cost, during working hours, in a way that does not compromise other firms’ confidentiality. We would ask that you use the written route first; it is quicker for both of us, and it is usually what your questionnaire actually needs.

Getting a signed data processing agreement

This page sets out our processor terms and forms part of the terms of service. Most firms will also want a signed Article 28 agreement for their own file, and we sign one with every firm before any live client data goes in. Where a signed agreement is in place, it takes precedence over this page.

Request a copy from dataprotection@matterlink.co.uk. If your firm has its own processor terms it prefers to use, send them over — we would rather read yours than insist on ours.

Contact

MatterLink Ltd, [Registered office address], Glasgow, [Postcode]. Registered in Scotland, company number [Company number]. ICO registration [ICO registration number].