Data processing agreement

What this document is for#

This is the processor agreement: what is processed on your instructions, by whom, where, and what happens to it at the end. It is the document a security review asks for, and it is the one most worth reading in full rather than in summary.

It is written against what the product actually does, including the providers the hosted service uses.

Roles#

For data you put into the product, you are the controller and we are the processor. We process it on your documented instructions, which for ordinary use are the instructions implied by using the product: to compute, cite and produce what you asked for.

For the account and contact details we hold in order to have a relationship with you, we are the controller.

What is processed#

The categories are listed in the privacy policy and are not repeated differently here: tax documents and extracted figures, entity and filing data, questions and answers with their reproducibility references, and an audit trail.

Special-category data is not required by the product. Where a national identifier is present in a document, it is encrypted at rest and stored display fields keep only masked values.

Security measures#

The measures are published in full on the security page and the trust page rather than summarised into a paragraph here, because a summary is what gets out of date. The ones that bear directly on processing:

• Structural tenant isolation, enforced by the data model rather than by application logic.
• Encryption at rest for sensitive extracts; masked values in display fields.
• Hash-chained audit entries per tenant, with a validator for the whole chain.
• Role-based access including a read-only auditor role.
• Deterministic redaction of identifiers before any text enters a prompt, a support surface or a dataset.

Sub-processors#

AI models run on TaxOrch's own servers: there is no third-party AI provider in the request path, so your questions and documents are not sent to one.

A change to this list is notified in advance rather than discovered.

International transfers#

For the hosted service, data may be processed where the sub-processors above operate. Where personal data leaves the UK or the EEA, the transfer relies on an adequacy decision or on the Standard Contractual Clauses, with the UK Addendum where UK data is involved.

Retention, return and deletion#

Retention is configurable with a seven-year default for tax documents, and a retention-eligibility report lists what is due for removal. A legal-hold flag blocks deletion for records under dispute or audit.

On termination, a per-tenant privacy export produces all of your tax data. Deletion is an explicit path and the deletion itself is written to the audit log.

Breach notification#

The response commitments published for security disclosures are what we hold ourselves to for reports we receive. The notification period we owe you as a processor is a term to settle in writing, and stating a number here before that is settled would be stating a term nobody has agreed.

Audit and assistance#

The audit trail is available to you, including through a read-only auditor role, so most of what an audit right is for can be exercised directly rather than requested.

There are no compliance certifications. Nothing here is SOC 2, ISO 27001 or equivalent, and no such claim appears anywhere on this site. If a certification is a requirement for you, it is a gap today and worth raising before anything else.

Signing this#

This agreement applies to the hosted service from its effective date. If your organisation needs a countersigned copy, or its own processor terms, write to privacy@taxorch.com and one will be prepared for signature.