Updated February 1, 2026
This Data Processing Agreement (“DPA”) forms part of the agreement (the “Agreement”) between:
Acodei Software, LLC (“Acodei”), and
The customer using Acodei’s services (“User” or “Customer”),
each a “Party” and together the “Parties.”
To the extent Acodei processes User Personal Data (as defined below) on behalf of User in the course of providing the Services, the Parties agree to comply with this DPA.
1.1 “Data Protection Laws” means all laws and regulations applicable to the processing of Personal Data under the Agreement, which may include, as applicable:
1.2 “Controller,” “Processor,” “Data Subject,” “Personal Data,” “Personal Data Breach,” “Processing,” and “Supervisory Authority” have the meanings given in the applicable Data Protection Laws.
1.3 “User Personal Data” means any Personal Data processed by Acodei on behalf of User under the Agreement, as further described in Annex A (Details of Data Processing).
1.4 “Sub-processor” means any third party engaged by Acodei that processes User Personal Data on behalf of Acodei in connection with the Services.
1.5 “Services” means the Acodei services provided to User under the Agreement, including data synchronization between payment processors and accounting systems.
2.1 Roles. For the purposes of Data Protection Laws, User is the Controller (or a Processor acting on behalf of its own controller) and Acodei is a Processor of User Personal Data.
2.2 Scope. This DPA applies solely to Acodei’s processing of User Personal Data in the course of providing the Services, as described in Annex A.
2.3 Instructions. Acodei will process User Personal Data only on documented instructions from User, including with regard to transfers of User Personal Data to a third country or international organization, unless required to do so by applicable law. In such case, Acodei will inform User of that legal requirement before processing, unless the law prohibits such disclosure.
2.4 User Responsibilities. User is responsible for:
3.1 The subject matter, nature and purpose of the processing, categories of Data Subjects, categories of Personal Data, and duration of processing are set out in Annex A (Details of Data Processing).
4.1 Acodei will ensure that persons authorized to process User Personal Data are bound by appropriate confidentiality obligations (whether contractual or statutory).
4.2 Acodei will not disclose User Personal Data to any third party except as permitted under this DPA, the Agreement, or as required by law.
5.1 Security Measures. Taking into account the state of the art, costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk to Data Subjects, Acodei will implement and maintain appropriate technical and organizational security measures to protect User Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures are described in Annex C (Technical and Organizational Security Measures).
5.2 Security Obligations of User. User is responsible for maintaining appropriate security, including:
6.1 Authorized Sub-processors. User authorizes Acodei to engage the Sub-processors listed in Annex B, as well as any additional Sub-processors that Acodei may engage in accordance with this Section 6.
6.2 Sub-processor Obligations. Acodei will:
6.3 Changes to Sub-processors. Acodei may add or replace Sub-processors. Acodei will provide User with at least 30 days’ prior notice of any intended changes (via email, dashboard notification, or posting at https://acodei.com/sub-processors) and give User an opportunity to object on reasonable grounds relating to data protection. If User reasonably objects, the Parties will discuss in good faith. If they cannot reach a mutually acceptable solution within 30 days of User’s objection, User may terminate the affected Services on written notice (to the extent use of the new Sub-processor cannot be reasonably avoided).
7.1 Acodei may process and transfer User Personal Data in and to locations where Acodei or its Sub-processors maintain operations, subject to this DPA and applicable Data Protection Laws.
7.2 Where required under Data Protection Laws for transfers of User Personal Data from the EEA, UK, or Switzerland to countries not recognized as providing an adequate level of protection, the Parties will rely on the applicable Standard Contractual Clauses (“SCCs”) adopted by the European Commission (Module 2: Controller to Processor), the UK International Data Transfer Addendum, or other valid transfer mechanism as updated or replaced from time to time by competent authorities. The Parties agree that by entering into this DPA, they are deemed to have executed the applicable SCCs, which are incorporated by reference.
7.3 In the event of conflict between the SCCs (if applicable) and this DPA, the SCCs will prevail to the extent necessary to comply with Data Protection Laws.
8.1 Data Subject Requests. Taking into account the nature of the processing, Acodei will provide reasonable assistance to User, by appropriate technical and organizational measures, for User to respond to requests from Data Subjects to exercise their rights under Data Protection Laws (for example, access, rectification, erasure, restriction, portability, and objection), to the extent such requests relate to User Personal Data stored within the Services.
8.2 Regulatory and DPIA Assistance. Acodei will provide User with reasonable cooperation and assistance, at User’s expense where applicable, with:
9.1 Notification. Upon becoming aware of a Personal Data Breach affecting User Personal Data, Acodei will notify User without undue delay (and in any event within 72 hours of becoming aware) and provide information reasonably required for User to meet its obligations to notify affected individuals and/or Supervisory Authorities, taking into account any legitimate law-enforcement or security constraints.
9.2 Content of Notification. To the extent available, Acodei’s notification will include:
9.3 Cooperation. Acodei will take reasonable steps to investigate, mitigate, and remediate the Personal Data Breach and will keep User informed of material developments, to the extent such information is available.
10.1 During the Agreement. Throughout the term of the Agreement, User may export certain User Personal Data from the Services using available functionality, where provided.
10.2 At Termination. Upon termination or expiration of the Agreement, Acodei will, at User’s choice and to the extent technically feasible:
within 30 days, unless a longer retention period is required by applicable law or necessary to protect Acodei’s legitimate interests (for example, for legal claims). Encrypted backups may be retained for up to 90 days in accordance with Acodei’s standard backup policies and will be securely deleted in the ordinary course.
11.1 Information. Acodei will make available to User all information reasonably necessary to demonstrate compliance with this DPA and Data Protection Laws in relation to User Personal Data.
11.2 Audits. Where required by Data Protection Laws and subject to reasonable notice, confidentiality, and security restrictions, User (or its independent auditor, not a competitor of Acodei) may conduct an audit of Acodei’s processing of User Personal Data. Audits will:
11.3 If Acodei makes available third-party audit reports or certifications (such as SOC 2 or ISO 27001), User agrees that such materials may satisfy its audit needs where appropriate.
12.1 The limitations and exclusions of liability set out in the Agreement apply to this DPA, unless otherwise prohibited by applicable Data Protection Laws.
13.1 This DPA will be governed by the governing law specified in the Agreement. If the Agreement does not specify governing law, this DPA will be governed by the laws of the State of Utah, United States, excluding its conflict-of-law rules.
13.2 To the extent required by Data Protection Laws, the mandatory provisions of the applicable data protection laws of the EEA member state, the UK, or Switzerland in which User is established will apply.
14.1 Acodei may modify this DPA as necessary to (a) reflect changes in the Services, (b) comply with applicable law or guidance, or (c) update Sub-processors or security practices. Acodei will provide at least 30 days’ notice of material changes, and such changes will become effective as stated in the notice or in accordance with the Agreement.
15.1 In the event of any conflict between this DPA and the Agreement, this DPA will govern with respect to Acodei’s processing of User Personal Data, unless otherwise expressly stated or required by Data Protection Laws.
Depending on how User configures and uses the Services, User Personal Data may relate to:
Individuals who register for or access an Acodei account on behalf of User (for example, owners, admins, finance staff, and accountants).
End customers of User who have transacted via connected payment processors (such as Stripe) and whose data is synchronized into connected accounting platforms (such as QuickBooks Online).
Individuals who communicate with Acodei via support channels (such as Help Scout) in relation to the Services.
Exact data elements depend on User’s configuration and the data transmitted by integrated platforms (such as Stripe and QuickBooks).
Note: Acodei processes only the payment details made available via User’s selected payment processors and accounting platforms and does not itself act as a payment processor.
Acodei does not intentionally collect or process special categories of Personal Data (such as health data or political opinions) or data relating to children, and the Services are not designed for such use. User is responsible for ensuring that special category data is not transmitted to the Services unless explicitly agreed in writing.
Frequency: Continuous and event-driven, as determined by User’s configuration, integrations, and automated synchronization tasks.
Nature: Collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, alignment, disclosure (to authorized recipients), and deletion.
Acodei processes User Personal Data for the following purposes:
Below is the current list of third-party Sub-processors that may process User Personal Data in connection with the Services. Acodei may update this list from time to time in accordance with Section 6.
Note: Locations are general regions. Each provider may use multiple sub-locations as part of their infrastructure.
Acodei implements and maintains the following technical and organizational measures to protect User Personal Data. These measures are reviewed periodically and updated as appropriate.