Data Processing Terms

1. Instructions

We process personal data in your records only to provide the verification service and as you instruct through the platform.

2. Security

We apply measures appropriate to the sensitivity of the data, including:

• Encryption in transit and at rest; encrypted storage of accounting connection tokens.
• Tenant isolation and role-based access; staff access limited to the work they perform and logged.
• Malware scanning of every uploaded file before it can be opened.
• Signed, time-limited download links; documents are never sent as email attachments.
• Audit logging of access to and changes of records.

3. Sub-processors

We use the following sub-processors. We inform you before adding or replacing a sub-processor that processes your records, so you can object. [Complete hosting provider and locations before go-live.]

• [Hosting and object storage provider — region to be confirmed]: application, database and document storage.
• Stripe: card payments (billing data only; no records or documents).
• [Transactional email provider]: notification emails (no documents are attached).
• Mistral AI (France) — optional, only once enabled: reading the text of invoices, bank statements and trade licences (OCR) through its EU endpoint, with zero data retention.

4. International transfers

[Hosting region and transfer safeguards to be confirmed.]

When automatic document reading is enabled, documents are transferred to the European Union for processing by Mistral AI under a data processing agreement with appropriate safeguards and are not retained after processing. [Transfer basis to be confirmed by counsel.]

5. Incidents

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.

6. End of service

At the end of the retention period, or on a verified deletion request, we delete or return your data, except where retention is legally required.