Data Processing Addendum

About this addendum

This Data Processing Addendum (the “DPA”) forms part of the Terms of Service (the “Terms”) between StableModels, LLC (“StableModels”, “we”, “us”) and the organization that uses Symphony (the “Customer”). It applies whenever we process Customer Personal Data in providing the Service, and it takes effect when the Customer accepts the Terms; no signature is needed. Words defined in the Terms, such as “Service” and “Customer Data”, have the same meaning here.

If this DPA and the Terms conflict on the processing of Customer Personal Data, this DPA governs. In everything else the Terms govern.

Definitions

• Customer Personal Data means personal information within Customer Data that we process on the Customer’s behalf in providing the Service.
• Data Protection Laws means the United States federal and state laws on the privacy and security of personal information that apply to a party’s processing of Customer Personal Data, including the California Consumer Privacy Act and comparable state laws, and the Gramm-Leach-Bliley Act and its rules to the extent they apply to the Customer.
• Individual means the person to whom Customer Personal Data relates, whom Data Protection Laws may call a consumer or data subject.
• Process means any operation performed on personal information, such as collecting, recording, storing, using, disclosing or deleting it.
• Security Incident means a breach of our security that leads to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data. It does not include unsuccessful attempts or activities that do not compromise its security, such as blocked sign-in attempts, scans or denial-of-service attacks.
• Subprocessor means a third party we engage that processes Customer Personal Data on our behalf to provide the Service.

Roles

For Customer Personal Data, the Customer is the business or controller, or, where it keeps books for its own clients, their service provider or processor. StableModels is the Customer’s service provider or processor, or, where the Customer acts for its clients, its subprocessor. The Customer is responsible for any instructions, permissions and notices its clients require, and we deal only with the Customer.

Instructions

We process Customer Personal Data only on the Customer’s documented instructions. The Customer instructs us to process it to provide, secure and support the Service as the Terms, this DPA and our Privacy Policy describe, and as the Customer and its members configure and use the Service, including the connections, modes, permissions and models they choose. Any other instruction needs our written agreement, and we may charge for work it requires.

We will tell the Customer if we believe an instruction violates Data Protection Laws, and we may decline to follow it. We may also process Customer Personal Data where the law requires, in which case we will tell the Customer first unless the law prohibits it.

Service provider commitments

Where Data Protection Laws apply to Customer Personal Data, we will not:

• sell it or share it for cross-context behavioral advertising;
• retain, use or disclose it for any purpose other than the business purposes set out in this DPA and the Terms, or outside our direct business relationship with the Customer, except as Data Protection Laws permit; or
• combine it with personal information we receive from or on behalf of anyone else, or collect from our own interactions with an Individual, except as Data Protection Laws permit.

We will comply with the obligations Data Protection Laws place on us as a service provider or processor and give Customer Personal Data the level of protection they require. We will tell the Customer if we determine that we can no longer meet those obligations. If we do, or if the Customer reasonably believes we are processing Customer Personal Data in an unauthorized way, the Customer may, by telling us, require us to take reasonable and appropriate steps to stop and remedy it.

Personnel

We give access to Customer Personal Data only to personnel who need it to provide, secure or support the Service, and they are bound by obligations of confidentiality.

Security

We maintain administrative, technical and physical safeguards designed to protect Customer Personal Data, including those listed under Security measures. We may change them as the Service and threats change, provided the changes do not materially reduce the overall protection of Customer Personal Data.

The Customer is responsible for how it configures and uses the Service, including whom it admits as members and with what role, which modes, permissions and connections it enables, and keeping its members’ sign-in accounts and credentials secure.

Security incidents

If we confirm a Security Incident, we will notify the Customer’s administrators without undue delay, take reasonable steps to contain and investigate it, and give the Customer the information about it we reasonably can as it becomes available, so that the Customer can meet its own obligations. The Customer is responsible for any notices to its clients, Individuals and authorities, unless the law requires us to give them. Our notice of a Security Incident is not an admission of fault or liability.

Requests from individuals

If we receive a request from an Individual to exercise a right under Data Protection Laws regarding Customer Personal Data, we will, unless the law prohibits it, tell the Customer and direct the Individual to it, and we will not answer the request ourselves except as the law requires. The Customer is responsible for responding. Taking into account the nature of the processing, we will provide reasonable assistance through the features of the Service, and other assistance at the Customer’s reasonable cost.

Customer responsibilities

• The Customer has given every notice, obtained every consent and authorization, and has every right that Data Protection Laws and its agreements with its clients require for us to process Customer Personal Data as this DPA describes, including its clients’ authorization to connect their books to the Service.
• The Customer’s instructions, and its use of the Service, comply with Data Protection Laws.
• The Customer will not provide or cause the Service to read protected health information subject to HIPAA, payment card numbers subject to the Payment Card Industry Data Security Standard, government identification numbers, or passwords or other credentials for financial accounts, except as they appear in the accounting records of a company the Customer connects. The Customer is responsible for limiting what those records contain.
• The Customer is responsible for overseeing its service providers as the Data Protection Laws that apply to it require, and agrees that this DPA, the Terms and the assessments described under Assessments and audits are how it does so for us.

Subprocessors

The Customer generally authorizes us to engage Subprocessors. Our current Subprocessors are the service providers listed in our Privacy Policy, with what each does. Services that the Customer connects or allows, such as QuickBooks Online, accounts it connects through our integrations provider and external tool servers, are not our Subprocessors; the Customer directs the exchange of data with them, and their own terms govern it.

We will engage each Subprocessor under a written agreement with data protection obligations no less protective in substance than this DPA, as appropriate to what it does, and we remain responsible for its performance of those obligations, subject to the Terms.

Before a new Subprocessor begins processing Customer Personal Data, we will update the list and tell the Customer’s administrators through Symphony or by email. The Customer may object in writing within 15 days of that notice on reasonable grounds relating to the protection of Customer Personal Data, and we will discuss the objection in good faith. If we do not resolve it within a reasonable time, the Customer’s sole remedy is to stop using the Service and close its account, without a refund of fees already paid.

Assessments and audits

Once a year, on written request, we will answer a reasonable written security and privacy questionnaire about our processing of Customer Personal Data, and share any independent audit or certification report we then hold, under obligations of confidentiality. The Customer agrees that these satisfy any right it has to audit us.

Only where Data Protection Laws require more, or an authority with jurisdiction over the Customer requires it, may the Customer, or an independent auditor it appoints who is not our competitor and who signs a confidentiality agreement we accept, audit our compliance with this DPA. Such an audit may take place no more than once a year, on 30 days’ written notice and an audit plan we agree, during normal business hours and without unreasonably disrupting our business or compromising the security of the Service or other customers’ data. The Customer bears its costs and reimburses our reasonable costs, including our personnel’s time.

AI processing

• We do not use Customer Personal Data to train, fine-tune or otherwise develop any AI model, and we do not authorize our Subprocessors, including AI model providers, to use it to train their models.
• The Service performs bookkeeping work. It is not designed to make decisions that produce legal or similarly significant effects on Individuals, and the Customer will not use it to make them.

Deletion

When the Customer asks us to delete its organization or a project, or when its use of the Service ends, we will delete the Customer Personal Data we hold for it within 30 days, as our Privacy Policy describes, and confirm when it is done. Records in QuickBooks and other connected services are not affected, and Symphony is not a backup of them.

We may keep Customer Personal Data where the law requires, and in activity logs until they expire in the normal course. We will keep what we retain confidential, protect it as this DPA requires, and process it only for the purpose for which we keep it.

Liability and general

• Each party’s liability arising out of or relating to this DPA, however it arises, is subject to the Limitation of liability and other terms of the Terms, and counts toward the limits there.
• This DPA lasts for as long as we process Customer Personal Data, and the sections that by their nature should survive continue after that.
• We may update this DPA as the Terms describe for changes to them.
• The governing law and dispute resolution terms of the Terms apply to this DPA.

Processing details

Security measures

• The Service is served only over HTTPS.
• QuickBooks tokens are encrypted with AES-256-GCM under a separate key for each connection; those keys are encrypted with a key held in Cloudflare’s secrets store, and tokens are never returned to the application or shown to people.
• Each organization’s and each project’s data is kept in its own storage, and access is checked against the member’s organization and role on every request.
• Members sign in through Google; Symphony keeps only a keyed hash of the Google account identifier and issues short-lived sign-in tokens.
• Changes to connected books follow the modes and connection permissions the Customer sets, including member approval where required, and each proposed or applied change is recorded with its values before and after.
• AI model providers are reached only through our AI gateway, which holds the provider credentials; secrets are kept out of logs, and activity logs are kept for a limited period.
• Changes to the production Service are reviewed and deployed through an automated pipeline after passing checks on a separate staging environment.

Contact us

Questions and notices about this DPA, including objections to a Subprocessor and requests for our security questionnaire answers, go to legal@stablemodels.ai, or by mail to: