Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service and is entered into between the firm or individual subscribing to the App ("Customer", "Controller") and the operator of the App ("TaxWorkpaper AI", "Processor"). By using the App, Customer agrees to this DPA.

1. Roles and Scope

Customer is the Controller of the personal and financial data it enters into the App. TaxWorkpaper AI is the Processor and processes Customer data only on Customer's documented instructions, as necessary to provide the App's trial balance, journal entry, tax export, and engagement management features.

2. Categories of Data

The App processes the following categories of data on behalf of Customer:

• Client entity names, EINs, and tax return type classifications.
• Trial balance account data, balances, prior-year figures, and tax code mappings.
• Journal entries, adjustment records, and review notes.
• Firm member names, email addresses, and role assignments.
• Activity and sign-off history (user name, timestamp, field changed).
• QuickBooks Online account names, numbers, and balances retrieved via OAuth at Customer's direction.

3. Security Measures

TaxWorkpaper AI implements and maintains technical and organizational measures appropriate to the risk, including:

• Encryption of data in transit (TLS) and at rest.
• Per-firm (tenant) row-level isolation enforced at the database layer; each firm can only read, update, and delete its own records.
• Role-based access control limiting sensitive actions (deletion, import, export, QuickBooks management) to authorized firm members.
• Automatic session idle timeout (30 minutes of inactivity) terminating idle authenticated sessions.
• Secure storage and automatic rotation of OAuth refresh tokens for connected integrations.
• Audit logging of account and engagement changes for reviewer traceability.

4. Subprocessors

TaxWorkpaper AI engages the following categories of subprocessors to deliver the App: cloud hosting and database infrastructure, email delivery, payment processing, and accounting integrations (QuickBooks Online). Each subprocessor is bound by written obligations of confidentiality and security no less protective than those in this DPA. Customer will be notified of new or replacement subprocessors, and may object on reasonable data-protection grounds.

5. Confidentiality

TaxWorkpaper AI personnel authorized to process Customer data are bound by confidentiality obligations that survive termination of their access. Access is limited to personnel necessary for operating and securing the App.

6. Data Subject Rights

TaxWorkpaper AI assists Customer, to the extent possible, in fulfilling Customer's obligations to respond to data subject requests (access, correction, deletion, portability). Customer may export or delete Client data and disconnect integrated sources directly from the App.

7. Personal Data Breach

TaxWorkpaper AI will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer data, providing the nature of the breach, the categories and approximate number of records and data subjects concerned, the likely consequences, and the measures taken or proposed. TaxWorkpaper AI will take reasonable steps to mitigate and document the breach.

8. Data Return and Deletion

Upon termination of Customer's account, Customer may export its data through the App's export features for a limited period. After that period, or upon Customer's written request, TaxWorkpaper AI will delete Customer data from production systems, except where retention is required by law. Backups are overwritten on a rolling cycle consistent with the hosting provider's schedule.

9. Audits

Customer may audit TaxWorkpaper AI's compliance with this DPA, at Customer's expense, no more than once per calendar year and with reasonable notice. TaxWorkpaper AI will make available relevant documentation (such as security attestations and reports) to demonstrate compliance.

10. International Transfers

Where Customer data is transferred outside its country of origin, such transfers are made under appropriate safeguards, including Standard Contractual Clauses adopted by the relevant authority, or another lawful transfer mechanism.

11. Contact

For questions, breach notices, or data subject requests under this DPA, contact TaxWorkpaper AI support.