Data Processing Agreement
Data Processing Agreement
This DPA applies when Solid Accounting processes personal data on your behalf through any of our server-side services: the Online Invoicing Portal, Bank Feeds (add-on), Cloud Sync (add-on), or AI Training Contribution (opt-in, US customers only). In plain terms: you're the data controller (you decide what data to collect and why), and we're the data processor (we handle it on your behalf to provide the service).
If you only use the desktop app without any online add-ons, this DPA doesn't apply to you — your data never touches our servers.
What we process
Invoicing portal
| Data category | Examples | Why we process it |
|---|---|---|
| Customer contact info | Names, email addresses, phone numbers | To send invoices and payment links |
| Payment data | Invoice amounts, payment status, transaction IDs | To track payments and sync with your books |
| Address data | Billing and shipping addresses on invoices | To display on invoices as you've entered them |
| Invoice metadata | Invoice numbers, dates, line items, descriptions, due dates | To generate and deliver invoices |
Bank feeds (add-on)
| Data category | Examples | Why we process it |
|---|---|---|
| Bank account metadata | Account name, type, last four digits, institution name | To display connection status and identify accounts |
| Transaction data | Dates, amounts, payee names, categories, pending status | To import transactions into your desktop books |
| Connection metadata | Aggregator tokens, last sync timestamp, error status | To maintain the bank feed connection |
Bank login credentials are provided directly to the aggregator (Plaid/Yodlee) and never pass through our servers.
AI Training Contribution (opt-in, US customers only)
| Data category | Examples | Why we process it |
|---|---|---|
| Tokenized counterparty names | HMAC-SHA256 hashes of customer / vendor / employee names using a per-company salt | To train AI adapters on layout patterns without exposing real identities |
| Structural extraction data | Amounts, dates, account codes, transaction types, descriptions with PII scrubbed | To train AI adapters on what to extract from your vendor's PDF formats |
| Correction metadata | Which fields you edited vs. accepted, count of edits per example | To weight training examples and measure adapter quality |
| Source PDF hash | SHA-256 of the source PDF (not the PDF itself) | Deduplication — we never receive the raw PDF |
What we never receive under Training Contribution: raw customer / vendor / employee names, emails, phone numbers, addresses, bank account numbers, SSNs, tax IDs, or the source PDF itself. Direct identifiers are stripped before tokenization; the salt that tokenizes names never leaves your device.
Eligibility: This service is available only to customers with US billing addresses. Non-US customers cannot opt in.
Accountant-tier firms: If you're an Accountant-tier firm enabling Training Contribution on a client's file, you warrant that (a) you have the client's authorization to contribute anonymized data, or (b) the client's engagement letter covers this use. Solid Accounting's opt-in UI enforces per-file consent confirmation on first contribution.
Across all services
We process this data only according to your instructions — meaning: to provide the services you've activated. We don't use your data for our own purposes.
How long we keep it
Invoicing portal
- While your account is active: We store your invoice data to provide the service
- After you close your account: We retain data for 90 days so you can export it
- After 90 days: Permanently deleted from our systems and backups
Bank feeds
- Transaction cache: Retained for up to 7 days to handle sync failures, then automatically deleted
- Connection metadata: Retained while the bank feed add-on is active
- After disconnection or cancellation: All cached data deleted within 30 days
AI Training Contribution
- Contributed tokenized data retained for up to 24 months, with most-recent corrections superseding older ones for the same field
- When you opt out, we stop pulling from your contributions at the next training cycle (new adapters won't be trained on your data)
- You can request deletion of your historical contributions via the in-app Privacy Dashboard or by email; deletion completes within 30 days
- Previously-trained AI adapters contain only abstracted patterns, not recoverable personal data, so they are not regenerated on deletion (per the CCPA deidentified standard)
All services
- Exception: We may retain anonymized, aggregated data (e.g., total invoice counts, sync frequency metrics) that cannot identify any individual
Our security measures
We protect the data we process with:
- AES-256-GCM encryption at rest for the most sensitive data: payment-provider and bank access tokens, bank-feed account and transaction descriptions, payroll data, and your customers' names, email addresses and invoice contents
- HTTPS with TLS 1.2 or newer for connections from the internet
- Every server-side query scoped to the authenticated account (tenant isolation)
- Automatic API token rotation
- Rate limiting and failed login throttling
- Least-privilege, per-service system users on a self-managed server (no shared hosting)
For full details, see our Security Practices.
Sub-processors
We use third-party services to provide the invoicing portal. See our Subprocessor List for the current list.
Before adding a new sub-processor, we'll notify you by email at least 30 days in advance. You have the right to object (see the Subprocessor List for the objection process).
Data subject rights
Your customers may exercise their data protection rights (access, correction, deletion, portability) by contacting you — you're the controller. When you receive such a request, we'll help you respond:
- Response time: We'll provide the technical assistance you need within 10 business days
- What we can do: Export specific customer data, delete specific records, correct data at your instruction
- What you need to do: Verify the requester's identity and instruct us on how to respond
Breach notification
If we discover a personal data breach affecting data we process on your behalf:
- We'll notify you within 72 hours of becoming aware of the breach (as required by GDPR Art. 33)
- Our notification will include: nature of the breach, categories and approximate number of records affected, likely consequences, and measures taken or proposed
- We'll cooperate with you in notifying affected individuals if required
- We'll document the breach and our response for your records
Audit rights
You may audit our compliance with this DPA once per year. This includes:
- Documentation requests: We'll provide current security certifications, assessment results, sub-processor DPA status, data processing records, and incident history (if any)
- Inspections: You (or an independent auditor you appoint) may inspect our data processing practices, subject to reasonable advance notice, business hours, and confidentiality obligations
Requests should be sent to privacy@solidaccounting.com. We'll respond within 30 days.
Data return and deletion
When your account closes or you stop using the invoicing portal:
- Export period: You have 90 days to export all your data (CSV format, via the desktop app or by request)
- Permanent deletion: After 90 days, we permanently delete all your invoice data, customer data, and payment records from our production systems and backups
- Written confirmation: Upon request, we'll provide written confirmation that deletion is complete
International transfers
If you're in the EU/EEA and your data is processed in the United States (where our servers are located), we rely on Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914) as our legal mechanism for cross-border data transfers.
You can request a copy of our executed SCCs by emailing privacy@solidaccounting.com.
Legal Details
The sections above describe data processing in plain language. The sections below contain the formal legal terms required by GDPR Article 28. Where they overlap, the formal language controls.
Definitions
- "Controller": You, the Solid Accounting user who creates invoices and determines the purposes and means of processing your customers' personal data
- "Processor": Solid Accounting, which processes personal data on behalf of and under the instructions of the Controller
- "Personal Data": Any information relating to an identified or identifiable natural person, as defined in GDPR Art. 4(1)
- "Processing": Any operation performed on personal data, as defined in GDPR Art. 4(2)
- "Sub-processor": A third party engaged by the Processor to process personal data on behalf of the Controller
- "Data Subject": An identifiable natural person whose personal data is processed
- "Supervisory Authority": An independent public authority established by an EU Member State pursuant to GDPR Art. 51
Scope and Duration
This DPA applies to all processing of personal data by Solid Accounting on behalf of the Controller in connection with the Online Invoicing Portal, Bank Feed add-on, Cloud Sync add-on, and any future server-side services that process personal data on the Controller's behalf. Processing begins when the Controller first uses any covered service and continues until all personal data is deleted in accordance with this DPA.
Processing Instructions
The Processor shall process personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country, unless required to do so by Union or Member State law to which the Processor is subject. The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes applicable data protection law.
Confidentiality
The Processor shall ensure that persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access to personal data is limited to personnel who require such access to perform the services.
Security Measures
The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as described in GDPR Art. 32. These measures are detailed in the Security Practices document and include encryption, access controls, tenant isolation, and regular security assessments.
Sub-processor Engagement
The Controller provides general written authorization for the Processor to engage sub-processors listed in the Subprocessor List. The Processor shall: (a) notify the Controller of any intended changes to sub-processors at least 30 days in advance; (b) impose data protection obligations no less protective than those in this DPA on each sub-processor; and (c) remain fully liable to the Controller for the performance of each sub-processor's obligations.
Data Subject Rights
The Processor shall assist the Controller by appropriate technical and organizational measures, insofar as possible, for the fulfillment of the Controller's obligation to respond to requests for exercising data subject rights under GDPR Chapter III.
Data Protection Impact Assessments
The Processor shall assist the Controller with data protection impact assessments (DPIAs) and prior consultation with supervisory authorities, where required under GDPR Articles 35 and 36, to the extent that the Processor's processing activities are relevant to the assessment.
Breach Notification
The Processor shall notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach. Such notification shall include: (a) the nature of the breach; (b) the categories and approximate number of data subjects and records concerned; (c) the likely consequences; and (d) the measures taken or proposed to address the breach.
Deletion and Return
Upon termination of the services or upon request, the Processor shall, at the choice of the Controller, delete or return all personal data and delete existing copies unless Union or Member State law requires storage of the personal data.
Records of Processing Activities
The Processor shall maintain records of processing activities carried out on behalf of the Controller, as required by GDPR Article 30(2), including: the name and contact details of the Processor and Controller, the categories of processing carried out, international transfers and their safeguards, and a general description of technical and organizational security measures. These records shall be made available to the supervisory authority on request.
Audit
The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in GDPR Article 28, and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller. Audits shall be conducted with reasonable advance notice, during business hours, and subject to appropriate confidentiality obligations.
CCPA/CPRA Service Provider
To the extent that Solid Accounting processes personal information of California residents on your behalf, Solid Accounting acts as a "service provider" as defined by the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). Solid Accounting shall not sell or share (as defined by CCPA/CPRA) any personal information received from or on behalf of the Controller, retain or use personal information for any purpose other than performing the services, or combine personal information received from the Controller with personal information from other sources except as permitted by CCPA/CPRA.
UK Data Protection
For processing of personal data subject to the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, this DPA applies with the following modifications: references to "GDPR" include the UK GDPR; references to "EU Member State" include the United Kingdom; the competent supervisory authority is the UK Information Commissioner's Office (ICO); and international transfers from the UK rely on the UK International Data Transfer Agreement (IDTA) or UK Addendum to EU SCCs, as applicable.
Relationship to Other Agreements
This DPA supplements and is incorporated into the Payment Service Agreement, EULA, and any applicable Add-On Schedules. In the event of any conflict between this DPA and those agreements, this DPA shall prevail with respect to the processing of personal data. This DPA terminates automatically when all covered services are terminated, subject to the data deletion obligations described above.
Liability
Each party's liability under this DPA is subject to the limitations of liability set forth in the Payment Service Agreement and EULA.
Severability
If any provision of this DPA is found to be unenforceable or invalid under the laws of any jurisdiction, that provision will be modified to the minimum extent necessary, and the remaining provisions will remain in full force and effect.
Governing Law
This DPA is governed by the laws of the State of Delaware, without regard to conflict of laws principles. For matters related to GDPR, the applicable data protection law of the relevant EU Member State shall apply.