Data processing agreement

1.Scope and roles

1.1 The Customer is the controller and Usermode is the processor of the personal data contained in Customer Data (as defined in the terms), described in Annex 1. Usermode is a controller only for the account data described in the Privacy notice.

1.2 Words defined in the UK GDPR (such as personal data, processing, controller, processor, data subject and personal data breach) have the same meaning here. "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and any other law on the processing of personal data that applies to either party.

1.3 The Customer is responsible for having a lawful basis for the processing it instructs, and for the instructions it gives being lawful.

2.Processing on your instructions

2.1 Usermode processes the personal data only on the Customer's documented instructions, including with regard to transfers to a third country, unless the law requires otherwise; in that case Usermode will tell the Customer of that legal requirement before processing, unless the law forbids it.

2.2 The terms, this agreement, and what the Customer and its Users configure and do in Paper Free Finance (the mailboxes and ledgers they connect, the documents they send, the policies, retention period and legal holds they set, and the exports they request) are the Customer's complete instructions.

2.3 Usermode will tell the Customer immediately if, in its opinion, an instruction infringes Data Protection Law.

3.People who process the data

3.1 Usermode ensures that everyone it authorises to process the personal data is bound by a duty of confidentiality, contractual or statutory, and has access only as far as their work needs it. Access to production systems is limited to named engineers who need it and protected by multi-factor authentication.

4.Security

4.1 Usermode implements the technical and organisational measures in Annex 2, which are designed to meet Article 32 of the UK GDPR, and keeps them under review. It may change them provided the overall level of protection is not reduced.

5.Personal data breaches

5.1 Usermode will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Customer's personal data, so that the Customer can meet its own 72-hour duty to notify the Information Commissioner.

5.2 The notice will describe, as far as is then known, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Usermode will add information as it becomes available and take reasonable steps to contain the breach and reduce its effects.

6.Sub-processors

6.1 The Customer gives Usermode general authorisation to engage the sub-processors listed in Annex 3.

6.2 Usermode will give the Customer's owners at least 30 days' notice, by email and on this page, before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may end the agreement without penalty and receive a refund of fees paid for the period after it ends.

6.3 Usermode imposes data protection obligations on each sub-processor that are no less protective than this agreement, and remains liable to the Customer for its sub-processors' performance.

6.4 The ledgers and mailboxes the Customer connects to Paper Free Finance (listed at the end of Annex 3) are the Customer's own providers under the Customer's own contracts, not Usermode's sub-processors. Usermode sends data to them, and reads data from them, on the Customer's instruction.

7.International transfers

7.1 Customer Data is stored in the United Kingdom (AWS eu-west-2, London). Usermode will not make a restricted transfer of the Customer's personal data except to the sub-processors in Annex 3 and with the safeguards stated there: adequacy regulations, the UK International Data Transfer Agreement or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework.

7.2 Documents are read by Claude models on Amazon Bedrock. UK-only deployments process requests in London without cross-region fallback. Other deployments may use an EU inference profile, processing requests in another AWS region in Europe; the UK's adequacy regulations cover the EEA. Anthropic's own API processes in the United States and requires the Customer's written opt-in; it is unavailable in UK-only deployments.

8.Helping you meet your obligations

8.1 Taking into account the nature of the processing, Usermode will help the Customer, by appropriate technical and organisational measures, to respond to requests from data subjects exercising their rights. Paper Free Finance lets the Customer find, correct and export the records it holds, and Usermode will pass on without delay any request it receives directly, without answering it except on the Customer's instruction.

8.2 Usermode will help the Customer comply with Articles 32 to 36 of the UK GDPR (security, breach notification, data protection impact assessments and prior consultation with the Information Commissioner), taking into account the information available to it.

9.Return and deletion of data

9.1 The Customer can return its data to itself at any time: an owner can export the whole organisation (every invoice, line, approval, supplier, original document and audit event, with a manifest signed by Usermode listing the SHA-256 of every file) from Settings in Paper Free Finance.

9.2 When the agreement ends the Customer has 30 days to export. After that Usermode deletes the Customer's personal data, unless the law requires it to be kept, as follows:

1. records in the database are deleted;
2. originals in the write-once archive are protected by Object Lock in compliance mode, which nobody, including Usermode and Amazon, can override before the lock expires. They are already encrypted under a key that belongs to the Customer's organisation alone; Usermode destroys that key, which makes them permanently unreadable, and the ciphertext is deleted when each lock expires;
3. backups expire within 35 days.

9.3 On request, Usermode will confirm in writing that deletion is complete.

10.Retention schedule

The Customer can keep any record longer by placing a legal hold on it, or keep everything longer by choosing a longer retention period in Settings.

11.Information and audits

11.1 Usermode makes available all information necessary to demonstrate compliance with Article 28 of the UK GDPR: this agreement, the security page, its policies and, once available, the summary of its most recent independent penetration test and its Cyber Essentials certificate.

11.2 Where that information is not enough, Usermode will allow and contribute to audits, including inspections, by the Customer or an auditor it appoints who is bound by confidentiality, on at least 30 days' notice, during business hours, no more than once a year unless a regulator requires it or after a personal data breach, and without access to other customers' data. Each party bears its own costs.

12.Liability, term and precedence

12.1 Each party's liability under this agreement is subject to the limits in the terms. This agreement lasts as long as Usermode processes personal data for the Customer. If it conflicts with the terms on the processing of personal data, this agreement prevails.

12.2 Questions about this agreement: [privacy contact email: to be confirmed].

Annex 1: Details of the processing

Annex 2: Technical and organisational measures

• Isolation between customers: every customer table is protected by database row-level security in force for every role, including the schema owner; the services connect with restricted roles that cannot switch it off.
• Encryption: TLS 1.3 in transit; database, storage and backups encrypted at rest with AWS KMS; documents and stored credentials additionally encrypted before storage under a key belonging to the customer's organisation.
• Integrity: originals kept in Amazon S3 with Object Lock in compliance mode; each sealed with SHA-256 and SHA-384 hashes signed with Ed25519 and ML-DSA-65; an append-only, hash-chained audit trail signed nightly.
• Access control: role-based permissions within each organisation; passwords of at least 12 characters; passkeys and two-factor authentication; scoped, revocable API keys stored only as hashes; rate limits on sign-in.
• Application security: uploads checked by content type and size and held in quarantine before archiving; documents treated as data, never as instructions, by the models that read them; strict content security policy; cross-site request forgery checks; problem responses without internal details.
• Operations: infrastructure as code in AWS London; least-privilege service roles; secrets in AWS Secrets Manager; dependency and container scanning, signed images and build provenance; point-in-time database recovery for 35 days; incident response and breach notification procedures with a 72-hour clock.
• People: confidentiality obligations, access on a need-to-know basis, removal of access on leaving.

Annex 3: Sub-processors

Services the Customer connects

These are the Customer's own providers, chosen and contracted by the Customer (clause 6.4). Paper Free Finance exchanges data with them only when the Customer connects them.