Draft for review by our lawyer and CA before launch. Not yet in force.
Data processing terms
1. Roles
For personal data in the records you enter, you are the data fiduciary and we are your data processor.
2. Instructions
We process that data only to provide the service and on your documented instructions, which include using the app.
3. Security
Data is isolated per company by row-level security, encrypted in transit and at rest, backed up continuously, and every change is audit-logged. Staff access needs two-step verification and every look at your account is logged and shown to your owner.
4. Sub-processors
Hosting, database, payment, messaging and email providers. We give notice in the app before adding a new one.
5. Breaches
We tell you without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting your data.
6. End of service
After the read-only period we delete your data, except what the law requires us to keep.