Data Processing Agreement

Draft — pending attorney review. This outline lists the clauses this agreement will contain. It is not yet in force.

1. Roles

• The firm is the controller (or business) for its client data; CPA Practice Hub is the processor (or service provider) and acts only on the firm's documented instructions.

2. Subject matter and duration

• Processing that is needed to provide the service, for as long as the subscription runs plus the read-only and closing periods described in the Terms.

3. Types of data

• Client names and contact details, document checklists, engagement notes and activity, and independence-register entries.
• [Counsel: whether taxpayer information as defined by IRC §7216 and the FTC Safeguards Rule is in scope, and the obligations that follow.]

4. Processor obligations

• Confidentiality of personnel.
• Security measures, including tenant isolation, role-based access, encryption in transit, an audit trail, and two-factor sign-in.
• Assistance with data-subject requests, incidents, and audits. [Counsel to detail.]

5. Subprocessors

[Counsel: the list (Vercel, Supabase, Stripe, Resend) and how changes are notified.]

6. AI processing

None. No firm or client data is sent to AI providers. Any future AI feature needs a separate signed agreement with the model provider, must be enabled by the firm, and labels every AI-generated suggestion as AI-generated.

7. International transfers

[To be completed by counsel.]

8. Security incidents

[To be completed by counsel: notice timing, content, and cooperation.]

9. Return and deletion

• Full export is available at any time and during the 30-day read-only period after cancellation.
• Deletion follows the retention schedule. No automated purge runs until the retention policy is approved.

10. Audits

[To be completed by counsel.]