GDPR
The General Data Protection Regulation (GDPR) governs how organizations handle personal data of EU residents. This page is the operational reference for what Solid Accounting does to comply, what data we hold, and how to exercise your rights as a data subject.
What personal data we hold
Solid Accounting (the company) holds a deliberately narrow set of personal data on you, the customer:
| Field | Where | Why |
|---|---|---|
| Name | License server | Receipts, support, license records |
| Email address | License server | License delivery, billing receipts, optional release notifications |
| Billing address | Payment processor (Stripe) | Sales-tax compliance, invoice generation |
| Payment-method metadata (last 4, expiry) | Stripe | Payment processing |
| License keys + activation history | License server | Anti-piracy, support |
| Support tickets + email correspondence | Helpdesk system | Resolution + history |
| Encrypted cloud backup (if you use our storage) | Our cloud storage provider | Encrypted on your computer before upload; we cannot read it |
| Bank feed transactions (if you turn on bank feeds) | Our server, via Plaid | Delivering transactions to your app |
| Invoices you send online (if you use Cloud Invoicing) | Our server | So your customers can view them online |
| Usage data and error reports (only if you say yes) | Our server, 90 days | Fixing bugs and product decisions; tied to a random install ID. See what has been sent or delete it under Settings → Privacy |
What we don't hold:
- Your company file
- Your bank passwords (you give them to Plaid, not to us)
- Anything in your Audit Trail
Unless you turn on bank feeds or Cloud Invoicing, we also don't hold your customers', vendors' or employees' names or any of your transaction amounts. That data lives in your company file on your computer.
Your rights as an EU data subject
Under GDPR you have the right to:
| Right | How to exercise |
|---|---|
| Access — see what data we hold on you | Email privacy@solidaccounting.com. Turnaround: 30 days max; usually same week. |
| Rectification — correct inaccurate data | Same email; we update the records and confirm. |
| Erasure ("right to be forgotten") | Same email. We delete what we can; license-records have a 7-year retention requirement under tax law that we honor — see Erasure caveats below. |
| Portability — get your data in a machine-readable format | Same email. JSON export of everything we hold within 30 days. |
| Restriction — pause our processing | Effectively the same as deletion for our use case; we'll process the request the same way. |
| Objection — object to processing on legitimate-interest grounds | We process on contract (your purchase) and legal-obligation (tax) grounds; objection is limited but we'll engage on case-by-case. |
| Lodge a complaint with a supervisory authority | Your home-country DPA. We won't try to dissuade this. |
Erasure caveats. Tax law in most jurisdictions requires retention of sales records for 7 years (varies by country). We retain license-purchase records for that period regardless of erasure requests, but we segregate them and stop using them for marketing or operational purposes. After 7 years, full deletion.
If you use encrypted cloud backup on our storage, erasure is immediate — the blocks are deleted from the destination. Note that we cannot decrypt them anyway, so all we're deleting is opaque ciphertext.
Lawful basis for processing
| Activity | Lawful basis |
|---|---|
| License sale + delivery | Contract (Article 6(1)(b)) |
| Tax-record retention | Legal obligation (Article 6(1)(c)) |
| Service emails (license delivery, renewal notices) | Contract |
| Marketing emails (release notes, blog) | Consent — opt-in only; opt-out at any time |
| Encrypted cloud backup | Contract; you elected this in setup |
| Bank feeds via Plaid | Contract; you elected this in setup |
| Anti-fraud / abuse detection | Legitimate interest (Article 6(1)(f)) |
Sub-processors
We use these third parties to provide the service:
| Sub-processor | Purpose | Data shared |
|---|---|---|
| Stripe | Payment processing | Name, email, billing address, payment method |
| Cloud storage provider | Encrypted cloud backup storage | Encrypted blocks (we have no decryption key) |
| Plaid | Bank feeds | Your bank connection; bank passwords go to Plaid, not to us |
| Postmark | Transactional email delivery | Email addresses + email content |
| Cloudflare | CDN + DDoS protection for the marketing site | Standard web logs |
| GitHub | Source-code hosting | None of yours |
| Anthropic | Used internally for screenshot agent | None of yours |
Each is GDPR-compliant in their own right. We have data-processing agreements with all of them where required.
Data residency for EU customers
For customers needing strict EU residency:
| Data | Default location | EU option |
|---|---|---|
| Company file | Your computer (your residency) | — |
| Encrypted cloud backup (our storage) | US | Choose your own EU bucket instead |
| Encrypted cloud backup (your own destination) | Whatever you configure | Use an EU bucket |
| Bank feed transactions | US (our server and Plaid) | None yet; don't turn on bank feeds |
| License-server records | US | EU mirror in development; targeted Q4 2026 |
| Email delivery | US (Postmark) | EU option in development |
For maximum strictness right now: keep your company file in the EU (your computer and local backups), send encrypted cloud backups to your own EU bucket, leave bank feeds and Cloud Invoicing off, accept that your license-purchase record (name, email, billing address, license key) is in the US until our EU mirror ships. That residual data is small and clearly within GDPR's permitted-transfer regime under Standard Contractual Clauses.
DPA, breach notification and DPO
Data Processing Agreement (DPA). Our standard terms include processing terms compatible with GDPR. For customers requiring a bilateral DPA on their own paper or our standard signed version:
- Email
privacy@solidaccounting.com - We respond within 3 business days
- Standard signature turnaround: 5-10 business days
- We charge nothing for DPAs — they're table-stakes
Breach notification. If we detect a breach affecting EU personal data, we notify the relevant DPA within 72 hours per Article 33, and notify affected customers without undue delay.
For customers, we go further: we publish a public incident report on solidaccounting.com/security/incidents within 30 days of any confirmed breach, even when notification isn't legally required.
Data Protection Officer. Our DPO is David Ford (privacy@solidaccounting.com). Pre-launch, this is a pragmatic-not-formal designation; post-launch we may delegate to a dedicated DPO if customer base size warrants.
Cross-references
- Compliance overview — full status table
- SOC 2 — privacy controls also covered under SOC 2 scope
- Security whitepaper — technical controls protecting personal data