Data Processing Agreement

Last updated: October 9, 2026

When finalized and executed, this Data Processing Agreement ("DPA") will form part of the Terms of Service or other written agreement (the "Agreement") between LedgerBeaver LLC, a Texas limited liability company ("LedgerBeaver," "Processor"), and the customer entity ("Customer," "Controller") that uses the Service. It describes LedgerBeaver's processing of Personal Data on Customer's behalf. This published draft is not an executed agreement.

• 1. Definitions
• 2. Roles
• 3. Scope & instructions
• 4. Confidentiality
• 5. Security
• 6. Sub-processors
• 7. Data-subject rights
• 8. Breach notification
• 9. International transfers
• 10. Audits
• 11. Return & deletion
• 12. US state laws
• Annex A & B

1. Definitions

Capitalized terms not defined here have the meaning given in the Agreement. "Personal Data," "Controller," "Processor," "Data Subject," "Processing," and "Supervisory Authority" have the meanings in the EU General Data Protection Regulation (GDPR). "Customer Data" means data Customer submits to the Service. "Data Protection Laws" means all privacy and data-protection laws applicable to a party's processing, including the GDPR, UK GDPR, and US state privacy laws such as the CCPA/CPRA. "Personal Data" under this DPA is the subset of Customer Data that identifies or relates to an identifiable individual.

2. Roles of the parties

For Personal Data contained in Customer Data, Customer is the Controller (or a processor acting for another controller) and LedgerBeaver is the Processor. LedgerBeaver processes such Personal Data only to provide and support the Service. LedgerBeaver is an independent Controller for a limited set of data it needs to run its business — account registration details, billing records, and Service usage/security logs — which it processes under its Privacy Policy.

3. Scope and processing instructions

LedgerBeaver will process Personal Data only: (a) to provide the Service in accordance with the Agreement; (b) as further documented in Customer's use and configuration of the Service; and (c) as otherwise instructed in writing by Customer, where consistent with the Service. The subject-matter, duration, nature, and purpose of processing, and the categories of Personal Data and Data Subjects, are described in Annex A. LedgerBeaver will inform Customer if, in its opinion, an instruction infringes Data Protection Laws.

No sale; no advertising; no model training. LedgerBeaver does not sell or share Personal Data, does not process it for cross-context behavioral advertising, and does not use Customer Data to train machine-learning or AI models. These are commitments made under this DPA and in our Data & Compliance statement.

Customer-selected AI services. Customer's documented instructions may include enabling a connection and directing LedgerBeaver to disclose specified Personal Data to an AI service within the authorized access controls. The parties' roles depend on the actual arrangement and applicable law. A service independently engaged by Customer is not a LedgerBeaver sub-processor solely because Customer connects it. Where LedgerBeaver engages an AI provider to process Personal Data on Customer's behalf, the sub-processor requirements in Section 6 apply. Nothing in this section changes LedgerBeaver's no-training commitment or removes its responsibility for processing under this DPA.

A customer-selected provider's retention and model-training practices depend on its applicable terms and Customer's settings. An instruction to connect an agent is not, by itself, consent from every affected Data Subject or a substitute for a required legal basis. Local inference does not change the parties' roles, Data Subjects' rights, or LedgerBeaver's hosted processing described in this DPA.

4. Confidentiality

LedgerBeaver ensures that personnel authorized to process Personal Data are bound by appropriate confidentiality obligations and process Personal Data only on a need-to-know basis.

5. Security measures

LedgerBeaver implements and maintains appropriate technical and organizational measures to protect Personal Data, described in Annex B. These include, at minimum:

• Encryption of Personal Data in transit (TLS 1.2 or higher) and at rest (AES-256).
• Tenant isolation enforced at the database layer through row-level security, so one Customer's data is not accessible to another.
• Scoped, revocable access tokens for any AI agent Customer connects to the Service.
• Least-privilege, logged, and audited production access.
• A tamper-evident, hash-chained audit trail over financial records.

6. Sub-processors

Customer provides general authorization for LedgerBeaver to engage the sub-processors listed in Annex A to process Personal Data. LedgerBeaver: (a) imposes data-protection obligations on each sub-processor no less protective than those in this DPA; (b) remains liable for each sub-processor's performance; and (c) will give Customer advance notice of any intended addition or replacement of a sub-processor that processes Personal Data, giving Customer the opportunity to object on reasonable data-protection grounds. If Customer reasonably objects and the parties cannot resolve the objection, Customer may terminate the affected Service as its exclusive remedy.

7. Assistance with data-subject rights

Taking into account the nature of the processing, LedgerBeaver will assist Customer, by appropriate technical and organizational measures and insofar as possible, in responding to Data Subject requests to exercise their rights (access, correction, deletion, portability, restriction, objection). Where a Data Subject contacts LedgerBeaver directly regarding data LedgerBeaver processes for Customer, LedgerBeaver will refer them to Customer. Customer can also action many of these requests directly through the Service's export and account-deletion features.

8. Personal-data breach notification

LedgerBeaver will notify Customer without undue delay, and in any event within [TBD — e.g., 72] hours of becoming aware of a Personal Data breach affecting Customer's Personal Data. The notice will describe the nature of the breach, the categories and approximate number of Data Subjects and records affected (to the extent known), the likely consequences, and the measures taken or proposed. LedgerBeaver will reasonably assist Customer with its own breach-notification obligations.

9. International data transfers

LedgerBeaver hosts the core workspace on US-based infrastructure; service providers may process data in other countries as described in the Privacy Policy. Where LedgerBeaver processes Personal Data originating in the EEA, UK, or Switzerland, the parties agree that the applicable Standard Contractual Clauses (SCCs) — and the UK International Data Transfer Addendum where relevant — are incorporated into this DPA by reference and completed using the details in Annex A. [TBD: attach the operative SCC module and confirm transfer mechanisms and provider locations with counsel before execution.]

10. Audits

LedgerBeaver will make available to Customer information reasonably necessary to demonstrate compliance with this DPA. Upon reasonable prior written notice, and no more than once per year (unless required by a Supervisory Authority or following a breach), Customer may audit LedgerBeaver's compliance, which may be satisfied by LedgerBeaver providing a then-current third-party audit report or security documentation (for example, a SOC 2 report once available) in lieu of an on-site audit.

11. Return and deletion of data

On termination or expiry of the Agreement, LedgerBeaver will, at Customer's choice, delete or return Customer's Personal Data, and delete existing copies within a commercially reasonable period, except to the extent retention is required by law. Customer can export its data from the Service at any time before termination. Certain immutable audit records may be retained where required to preserve the integrity of the financial ledger and to meet legal record-keeping obligations; such records are retained only for as long as required and remain protected under this DPA.

12. US state privacy laws (Service Provider terms)

To the extent the CCPA/CPRA or a comparable US state law applies, LedgerBeaver acts as a "service provider" (or "processor"/"contractor") and: (a) will not sell or share Personal Data; (b) will not retain, use, or disclose Personal Data outside the direct business relationship or for any purpose other than providing the Service; (c) will not combine Personal Data with data from other sources except as permitted; and (d) certifies that it understands and will comply with these restrictions.

Annex A — Details of processing

Annex B — Technical & organizational measures

Encryption in transit (TLS 1.2+) and at rest (AES-256); database-level row-level security for tenant isolation; scoped and revocable API/agent tokens; least-privilege production access with logging; hash-chained tamper-evident financial audit log; secure software-development and dependency practices; incident-response process; sub-processor due diligence. A more detailed description is available to customers on request under NDA.

To discuss DPA requirements for your organization, email [email protected]. This draft must be completed and reviewed by qualified counsel before execution and does not replace advice from your own counsel.