Contents
- 1. Who this is between, and what it covers
- 2. Roles and instructions
- 3. The Firm's responsibilities
- 4. Our people
- 5. Security
- 6. Sub-processors
- 7. Requests from individuals
- 8. Security incidents
- 9. Other help
- 10. Returning and deleting data
- 11. Information and audits
- 12. Where data is processed
- 13. Duration and liability
- Annex 1: Details of the processing
- Annex 2: Security measures
- Annex 3: Sub-processors
1. Who this is between, and what it covers
This Data Processing Addendum (the “Addendum”) is part of the Terms of Service between Openbit Technology LLC, a Florida limited liability company (“Ledgerlight”, “we” or “us”) and the Firm. It covers personal information in Customer Data that we process for the Firm when providing Ledgerlight. If it conflicts with the Terms on how personal information is handled, this Addendum applies.
Words with capitals mean what the Terms say. “Personal Information” is information about an identified or identifiable person. “Data Protection Laws” are the privacy and data protection laws that apply to this processing, such as the California Consumer Privacy Act. A “Security Incident” is a breach of security that leads to Personal Information in Customer Data being accidentally or unlawfully destroyed, lost, changed, disclosed or accessed.
2. Roles and instructions
The Firm decides why and how its clients' information is processed: it's the controller (or a processor for its own clients), and we're its processor, or “service provider”. We process Personal Information only on the Firm's documented instructions: these Terms, the Firm's use of Ledgerlight's settings, and anything else we agree in writing. We'll tell the Firm if we believe an instruction breaks Data Protection Laws.
As a service provider, we won't:
- sell or share the Personal Information, as those words are used in the California Consumer Privacy Act;
- keep, use or disclose it for any purpose other than providing Ledgerlight to the Firm, or outside our relationship with the Firm;
- combine it with personal information from elsewhere, except as Data Protection Laws allow.
3. The Firm's responsibilities
The Firm makes sure it may lawfully connect its clients' books and share reports with the people it invites, gives its clients any notices and gets any consents they're owed, and avoids putting information in Ledgerlight it doesn't need there (for example, sensitive details in transaction memos).
4. Our people
Only people who need it to provide or support Ledgerlight can reach Customer Data, and they're bound to keep it confidential. Our support team's access to a Firm's workspace is read-only and recorded in the Firm's activity log.
5. Security
We keep the technical and organizational measures in Annex 2. We may improve them over time, but won't make them materially weaker.
6. Sub-processors
The Firm agrees that we may use the sub-processors in Annex 3. Before adding or replacing one, we'll update that list and email the Firm's owners at least 30 days ahead. The Firm may object on reasonable data protection grounds within that time; if we can't resolve it, the Firm may end the affected service and get back fees prepaid for the time after it ends.
Each sub-processor is bound by data protection terms at least as protective as this Addendum, and we remain responsible for its work.
7. Requests from individuals
If someone asks us to see, correct or delete Personal Information in a Firm's Customer Data, we'll pass the request to the Firm and won't answer it ourselves unless the Firm asks us to. We'll help the Firm answer such requests, using Ledgerlight's export and our support team.
8. Security incidents
We'll tell the Firm's owners without undue delay, and within 72 hours, after confirming a Security Incident affecting the Firm's Customer Data. We'll say what we know about what happened and what's affected, update the Firm as we learn more, and take reasonable steps to contain it and stop it happening again.
9. Other help
We'll give the Firm reasonable help, with information we have, for any assessment of the processing's privacy impact or consultation with a regulator that Data Protection Laws require.
10. Returning and deleting data
When the Terms end, or when the Firm closes its account:
- The Firm's owners can download its Customer Data as a ZIP file, before and while the Firm is closing.
- We delete the Customer Data from Ledgerlight 30 days after the deletion is scheduled, and it leaves our backups within a further 30 days.
- We confirm the deletion in writing if asked.
We keep only a short record that the Firm existed and closed, or what the law requires us to keep.
11. Information and audits
We'll make available the information needed to show we meet this Addendum: this document, our security page, and answers to a reasonable security questionnaire once a year. Any further audit is by agreement, at a time and scope we agree, at the Firm's cost.
12. Where data is processed
Customer Data is processed in the United States. If the Firm's law requires a transfer mechanism, we'll agree one.
13. Duration and liability
This Addendum lasts as long as we process Customer Data for the Firm. The Terms' limits on liability apply to it.
Annex 1 Details of the processing
| Item | Details |
|---|---|
| Subject and purpose | Providing Ledgerlight: reading the Firm's clients' books from QuickBooks Online, and turning them into dashboards and monthly reports the Firm shares with its clients. |
| Nature | Collecting, storing, organizing, analyzing, displaying, sending by email, exporting and deleting. |
| Duration | While the Firm uses Ledgerlight, then until deleted as described under “Returning and deleting data”. |
| People concerned | The Firm's owners and staff; its clients and the people at them it invites; and people named in clients' books, such as their customers, vendors and employees. |
| Types of information | Names and email addresses of people who sign in; names, transaction details, memos and amounts in clients' books; invoices and bills; reports, comments, clients' questions and the firm's answers, when reports were opened, and activity records. |
| Sensitive information | Not intended. The Firm avoids putting it in, for example in transaction memos. |
Annex 2 Security measures
- Hosting. Ledgerlight runs on Google Cloud (Cloud Run and Cloud SQL for PostgreSQL) in the United States, in Google's Iowa region. The database has no public address: the app reaches it over a private network, encrypted, with its certificate checked. Keys and passwords the app uses are kept in Google Secret Manager, not in the code.
- Encryption. Every connection to Ledgerlight is encrypted (HTTPS, with browsers told to insist on it). Google encrypts the database and its backups on disk. QuickBooks access tokens, QuickBooks company ids, two-factor secrets and the files clients send their firm are encrypted again by Ledgerlight, with AES-256-GCM and a key kept in Secret Manager.
- Signing in. Passwords are at least 12 characters and are stored only as scrypt hashes. Session tokens, one-time links and recovery codes are stored only as hashes too. Repeated sign-in attempts, wrong two-factor codes (5 at most) and reset requests are limited. Two-factor authentication with an authenticator app: each firm decides who must use it (its owners and staff, unless it chooses otherwise), and Ledgerlight's superadmins always do. Sign-ins last 7 days, or 12 hours for superadmins. Anyone can sign out their other devices, and a password reset signs out everywhere.
- Who sees what. A firm's owners and staff see its clients. A client sees only their own business, and only the reports the firm publishes. Owners manage their team, and see an activity log of changes in the firm: invitations, connections, reports, settings and more. Ledgerlight's support team can look into a firm to help, without being able to change anything; each look is recorded in the firm's activity log.
- QuickBooks. Ledgerlight only reads from QuickBooks Online; it never changes a client's books. A connection can be ended at any time, from Ledgerlight or from QuickBooks. Ledgerlight revokes its access when a connection is ended, a client is removed or a firm is deleted.
- Backups and monitoring. The production database is backed up daily, with backups kept 30 days, and can be restored to any moment in the last 7 days. Every QuickBooks update is recorded, and a connection that stops working is flagged to the firm's team by email.
- Email. Emails come from Ledgerlight's own domain, authenticated with SPF and DKIM. Ledgerlight keeps a record of each email it sends, but not its text, since emails can carry sign-in links.
- Leaving Ledgerlight. A firm's owners can download all of its data as a ZIP file at any time. When a firm closes, its data is deleted 30 days after the deletion is scheduled, and leaves the backups within a further 30 days.
Annex 3 Sub-processors
| Sub-processor | Purpose | Information | Location |
|---|---|---|---|
| Google Cloud (Google LLC) | Runs Ledgerlight: the app, its database and backups, its keys and its logs. Always. | Everything Ledgerlight holds | United States (Iowa) |
| Resend (Resend, Inc.) | Sends Ledgerlight's emails: invitations, sign-in links and notices. Always. | Recipients' email addresses and the emails' text, which can include names of people, firms and clients | United States |
| Twilio (Twilio Inc.) | Texts two-factor sign-in codes, through its Verify service. Only for people who choose to get their codes by text message. | The mobile number a code goes to. Never names, firms, clients or books | United States |
| Anthropic (Anthropic, PBC) | Drafts a monthly report's highlights for the firm to edit. Only for firms whose owner turns on AI drafts. | A client's figures and account names for the months in the report. Never the names of the firm, the client, or their customers or vendors | United States |
Intuit QuickBooks Online (Intuit Inc.) isn't a sub-processor: it's where the Firm's clients keep their books, connected by the Firm, and Ledgerlight reads from it.
Questions about this Addendum: support@openbitech.com.