1. Definitions
- "Customer Data" means any personal information the Customer uploads, submits or otherwise provides through the service, including documents, bank statements, transaction records, notes and related-party details.
- "Data Protection Laws" means the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and any other data protection law that applies, including the General Data Protection Regulation (EU) 2016/679 ("GDPR") to the extent it applies.
- "Personal Information" has the meaning given in the Privacy Act 1988 (Cth), and includes "personal data" as defined in the GDPR where it applies.
- "Processing" means any operation performed on Customer Data, including collection, storage, use, disclosure, analysis and deletion.
- "Security Incident" means any unauthorised access to, or unauthorised disclosure of, Customer Data.
- "Subprocessor" means a third party engaged by LedgerSignal to process Customer Data on the Customer's behalf.
2. Scope and purpose of processing
LedgerSignal processes Customer Data only to provide the service described in our terms of service. Processing includes:
- Storing the documents the Customer uploads (bank statements and other financial records)
- Reading accounts, statement periods and transactions from uploaded documents with an AI model from OpenAI, through our Cloudflare AI gateway
- Tagging transactions (such as transfers, related parties, gambling, wages and loans) with a decision model on Cloudflare Workers AI
- Turning the Customer's plain-English searches into filters, with the same OpenAI model
- Giving the Customer structured transaction data, search, history and CSV exports
- Authenticating users and managing firm membership and roles
- Sending service emails
Categories of data subjects: the Customer's employees, contractors and other authorised users, and the people whose personal information appears in documents the Customer uploads or details the Customer enters (such as account holders, transaction counterparties and related parties).
Categories of personal information: name, email address, firm name, IP address and browser details recorded with sign-in sessions, and the contents of uploaded financial documents (which may include names, addresses, bank account numbers, transaction descriptions and amounts).
3. Processor obligations
LedgerSignal will:
- Process Customer Data only on the Customer's documented instructions and as needed to provide the service
- Not sell Customer Data, or use or share it for any purpose other than providing the service
- Not use Customer Data to train AI models. Under their published API terms, Cloudflare doesn't use content processed by Workers AI to train models, and OpenAI doesn't train on data sent to its API unless the customer opts in.
- Make sure the people authorised to process Customer Data are bound by confidentiality obligations
- Comply with Data Protection Laws in processing Customer Data
- Tell the Customer without undue delay if a data subject asks us to exercise their rights under Data Protection Laws
4. Security measures
LedgerSignal uses appropriate technical and organisational measures to protect Customer Data from unauthorised access, disclosure, change or destruction, including:
- Encryption at rest. Cloudflare encrypts the account database and uploaded files with AES-256, and each case's database at rest.
- Encryption in transit. All connections to the service use HTTPS.
- Separation by case. Each case's content is kept in its own database, reached only through the app after it has checked that the case belongs to the requesting user's firm.
- Access control. Access is by firm membership, checked on every request, with roles for deleting and managing data. Users sign in with email and password; passwords are stored only as hashes.
- Document storage. Uploaded files are kept in private storage with no public link and served only after the same firm and case check.
- Point-in-time recovery. The account database and each case's database can be restored to any point in the last 30 days.
For more on our security practices, and what we don't offer yet, see our trust and security page.
5. Subprocessors
The Customer gives general authorisation for LedgerSignal to engage the subprocessors below. We'll tell the Customer by email at least 14 days before adding a new subprocessor. If the Customer objects within that period, we'll work to address the concern or offer a reasonable alternative; if we can't, the Customer may stop using the affected service.
| Provider | What it does | Where |
|---|---|---|
| Cloudflare | Runs the app and holds its data: the account database, each case's database, uploaded files, the AI gateway, the decision model that tags transactions, email sending, logs, product telemetry and site analytics. | Account database in the Oceania region. Uploaded files in Eastern North America (United States). Case databases are created in a data centre near whoever first opens the case. Requests are served from Cloudflare's global network. |
| OpenAI | Reads uploaded statements to find each account and its transactions, and turns plain-English searches into filters. Reached through our Cloudflare AI gateway. | United States |
| Google Workspace | Our email inbox, for messages you send us and notices that a new firm has started. | May be outside Australia |
LedgerSignal makes sure each subprocessor is bound by data protection obligations no less protective than those in this DPA. For each provider's certifications, see our trust and security page.
6. Cross-border data transfers
Some Customer Data is stored or processed outside Australia, as set out in the table above; the countries involved are likely to include the United States. LedgerSignal is an Australian company and acknowledges its obligations under APP 8 (cross-border disclosure of personal information). Before disclosing personal information to an overseas recipient, we take reasonable steps to make sure the recipient handles it in line with the APPs.
Where the GDPR applies, transfers are made in line with Chapter V of the GDPR, including Standard Contractual Clauses where required.
7. Data subject rights
LedgerSignal will help the Customer respond to requests from data subjects exercising their rights under Data Protection Laws, including access (APP 12), correction (APP 13) and deletion. If we receive a request directly from a data subject, we'll promptly pass it to the Customer unless the law requires us to respond ourselves.
8. Security incident notification
LedgerSignal will tell the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Customer Data. The notice will include:
- A description of the incident
- The categories and approximate number of data subjects and records affected
- The likely consequences
- The steps taken or proposed to address the incident and reduce its effects
LedgerSignal will cooperate with the Customer to investigate, contain and fix any Security Incident.
9. Audit and compliance
LedgerSignal will give the Customer, on request, the information needed to show compliance with this DPA. The Customer may request an audit of our data processing practices once a year, at its own expense and with reasonable notice. We may meet an audit request with security documentation or third-party audit reports, such as our subprocessors' SOC 2 reports. LedgerSignal itself doesn't hold a SOC 2 or ISO 27001 certification yet.
10. Data return and deletion
During the term, the Customer can export a case's transactions as CSV, and delete files, bank accounts and cases from within the app at any time. Deleting a case removes its database and every file uploaded to it.
When the agreement ends, or at the Customer's written request, LedgerSignal will delete all Customer Data within 30 days, unless the law requires us to keep it. Deleted data can remain in our providers' point-in-time recovery for up to 30 days before it expires. On request, we'll confirm deletion in writing.
11. Term
This DPA takes effect when the Customer agrees to our terms of service and lasts for as long as the Customer uses the service. Its obligations to protect Customer Data survive until all Customer Data has been deleted.
12. Liability
Each party's liability under this DPA is subject to the limits in the terms of service. LedgerSignal is liable for the acts and omissions of its subprocessors to the same extent as if it did the processing itself.
13. Conflict
If this DPA and the terms of service conflict, this DPA prevails on data protection matters.
14. Changes to this DPA
We may update this DPA from time to time. We'll tell the Customer about material changes by email at least 30 days before they take effect. Continuing to use the service after that date means accepting the updated DPA. Questions about this agreement: john@ledgersignal.com.