Data Processing Agreement
1. Roles
The Controller is an accounting firm using Solju to process bank transaction data and supporting documents on behalf of its own client companies. The Processor is Solju, acting only on the Controller's documented instructions as set out in this agreement and as configured by the Controller within the product.
2. Subject matter, nature and purpose
The Processor reads bank export files and receipt documents the Controller uploads, matches them to each other, and produces (a) renamed source documents and (b) a proposed accounting journal for import into the Controller's accounting system. Processing lasts for as long as the Controller has an active account, and for the retention period described in section 6 afterward.
3. Categories of data and data subjects
| Data | Data subjects |
|---|---|
| Bank transaction records: date, amount, counterparty name or description, reference text | The Controller's client company, and whoever the client company transacted with — suppliers, employees reimbursed through the account, occasionally an individual customer named in a transaction description |
| Receipt and invoice documents | The same, plus whichever names appear on the documents themselves — most often a business, occasionally an individual |
| The chart of accounts and category mappings the Controller configures | None directly — this is the Controller's own accounting structure |
Solju does not receive special categories of data (Art. 9 GDPR) by design, and the Controller should not upload documents containing them.
4. Processor obligations
- Process personal data only on the Controller's documented instructions — configuring and using the product as intended constitutes those instructions.
- Ensure anyone processing this data under the Processor's authority is bound to confidentiality.
- Implement the technical and organisational measures in section 5.
- Not engage a new sub-processor without giving the Controller the opportunity to object — see section 7.
- Assist the Controller in responding to a data subject request, to the extent the Processor's own systems can answer it.
- Notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, and in any case within 72 hours of the Processor itself becoming aware, so the Controller can meet its own Article 33 deadline where one applies.
- Make available the information reasonably necessary to demonstrate compliance with this agreement, and allow for an audit — [the mechanics of an audit right — notice period, frequency, who bears the cost — need agreeing specifically rather than left open-ended].
- Delete or return all personal data at the end of the relationship, per section 6.
5. Security measures actually in place
Named specifically rather than described in general terms that could mean anything, because a Controller relying on this should be able to check it:
- Tenant isolation enforced at the database, not only in application code — a firm's rows are separated by a database policy that is proven with an automated test, not assumed to hold because the application code is believed correct.
- Encryption in transit — TLS on every connection to the service.
- Least-privilege database access — the application itself connects with a role that cannot bypass the tenant-isolation policies above, even if the application code were compromised.
- An append-only audit trail of account and setting changes and of every document sent, enforced at the database so an entry cannot be edited or deleted after the fact, including by the Processor's own operator.
- No automatic decisions reach the Controller's books. Every proposed account and VAT code carries a confidence level and nothing is posted anywhere without the Controller's own review — relevant to this agreement because it bounds what an error in processing could actually cause.
- Encrypted nightly backups of uploaded documents (since 13.10.2026), to Cloudflare R2, in a bucket restricted to Cloudflare's EU jurisdiction. They are encrypted on the Processor's server before they leave it, with a key Cloudflare never receives, so Cloudflare holds only encrypted data. [For the office: whether the Hetzner Storage Box that held the first backups (13.10.2026) has been deleted is to be confirmed.] Thirty daily and twelve monthly copies are kept, and a restore is tested by comparing it with the live data, not assumed to work.
6. Retention and deletion
While the Controller's account is active, data is retained as described in the Privacy Policy. On termination, the Controller may request export of its data within [a period to be agreed], after which the Processor will delete it, except where a shorter or longer period is required by law or is already described in section 5's audit-trail commitment (which is append-only by design and is retained for the reason stated there, not deleted on request).
7. Sub-processors
Currently engaged for every Controller. Each stores data only within the European Union; Turnstile, which stores nothing for the Processor, is the one service that runs outside it (section 8):
| Sub-processor | What it processes | Location |
|---|---|---|
| Supabase | Sign-in and the application database: users' email addresses, firm and client records, settings, run records and the audit trail; it also sees the IP address of each sign-in request | Ireland (eu-west-1) |
| Hetzner Online GmbH | The server the application runs on, and the uploaded documents and generated output stored on it | Finland (Helsinki) |
| Cloudflare, Inc. | (1) Encrypted nightly backups of uploaded documents; it holds no key to read them. (2) Turnstile, the check against automated sign-ins on the sign-in page, which sees the visitor's browser and IP address | Backups: EU (R2 EU jurisdiction). Turnstile: Cloudflare's global network |
| Lettermint B.V. | Sending email: sign-in codes, invitations, the documents and journals the Controller asks to be delivered, and notices. It sees each message, its attachments and its recipients. [For the office: the provider of the mailbox that receives the Processor's own notices is to be confirmed.] | The Netherlands; EU infrastructure |
Engaged only for a Controller that switches on the AI reader in its firm settings, and only for the documents its users upload while it is on:
| Sub-processor | Role | Location |
|---|---|---|
| Anthropic, PBC | Reading receipts and invoices, to propose their values for a person to check (the AI reader). Every call is recorded for the Controller | United States or global processing; under its current terms, not used for training and, for the models used, not kept after answering |
The Processor will give the Controller reasonable advance notice before adding or replacing a sub-processor, during which the Controller may object on reasonable data-protection grounds.
Not sub-processors: the Finnish Patent and Registration Office (PRH), whose public open-data register the Processor asks about a client's business ID to propose its VAT registration - only the business ID is sent, and PRH is a public source, not a processor acting for the Controller [for the lawyer: a sole trader's business ID can be personal data]; and Fennoa or any other recipient the Controller itself chooses to deliver documents to, which receives them on the Controller's own instruction under the Controller's own agreement with it.
8. International transfers
Data is stored only within the EU. One sub-processor, Cloudflare, Inc., is a United States company: it holds the encrypted backups, in its EU jurisdiction, and never receives the key to them; and its Turnstile check on the sign-in page runs on its global network. [Whether that needs a transfer mechanism - Cloudflare's own data processing addendum and its standard contractual clauses, or the EU-US Data Privacy Framework - is for the legal review to confirm. The same question applies to Supabase: its data stays in Ireland, but the company it contracts through is established outside the EU.] For a Controller that switches on the AI reader, the documents its users upload are sent to Anthropic, PBC, a United States company, and processed outside the EU under the EU standard contractual clauses in Anthropic's data processing addendum. [For the legal review to confirm, together with the Cloudflare question above.] This section will be updated, and the Controller notified, if anything here changes.
9. Liability
[Needs the same legal review as the Terms of Service's liability section, and for the same reason: a processor's liability under Article 28 has its own case law and should not be templated without checking it against how this entity is actually structured.]
10. Duration
This agreement runs for as long as the underlying service agreement between the parties, and survives it for whatever period the Processor continues to hold the Controller's data under section 6.