Data Processing Agreement

Version 2026-10-20 · Effective 20 October 2026

1. Who this agreement is between

This Data Processing Agreement ("DPA") is between Unified Markets LLC, a Wyoming limited liability company trading as Cypher Outsourcing, 30 N Gould St Ste N, Sheridan, WY 82801 ("Cypher", "we"), and the business that accepts it during onboarding ("you", "the Client"). It forms part of the Cypher Terms of Service and works alongside our Privacy Policy. If this DPA and the Terms conflict on how your data is handled, this DPA wins.

For your business data, you decide why it is processed and we process it on your behalf. Under US state privacy laws (for example the California Consumer Privacy Act) we act as your service provider or processor.

2. What data we process

• Accounting records: transactions, accounts, invoices, bills, payments, reports and attachments in your QuickBooks Online or Xero company.
• Documents you send us: bills, receipts, bank and card statements and similar documents, by email or through the client portal.
• Business and contact details: your business name, entity details, contact names, emails and phone numbers, your CPA's details, and details of your customers, vendors and (for payroll clients) employees that appear in your records.
• Messages: emails and portal answers you send us.
• Billing details: your plan and payment status. Full card and bank numbers are held by Stripe, never by Cypher.
• Identity verification: before we start work, the person who signs our engagement letter verifies their identity through Stripe Identity, either with a photo of a government ID and a selfie or, for US residents, with their name, date of birth and Social Security number. Stripe collects and holds these details. Cypher receives only the result (verified or not), the date and Stripe's reference for the check; we never see or store the ID images or the full Social Security number.

We never ask for or keep your passwords, and you should not send us Social Security numbers, full bank account numbers or ID documents by email. Identity checks happen only on Stripe's secure page.

3. How we may use it

1. We process your data only to provide the services you signed up for (bookkeeping, month-end close, reports, bills and receipts, and any add-ons you chose), to bill you, to verify who we are working for, to support you, to keep the service secure and to meet our legal obligations.
2. We follow your documented instructions. This DPA, the Terms and your service choices are your instructions. If we think an instruction breaks the law, we will tell you.
3. We do not sell or share your data (as those words are defined in US state privacy laws), use it for targeted advertising, combine it with data from other clients or sources except as needed to provide the services, or keep, use or disclose it for any purpose outside our direct business relationship with you.
4. We may use anonymised, aggregated statistics that cannot identify you or any person (for example, how many receipts we matched in a month) to run and improve our service.

4. How we use AI

AI is part of how we deliver your service, so accepting this section is required to become a client. Specifically:

• What the AI does: reads bills, receipts and statements to pull out the vendor, date and amount; suggests the account for uncategorised transactions using your own past categories; checks the books before month-end close and writes findings for our review; and helps prepare your monthly report. Emails you send us as a client are read and answered by a person.
• Who provides it: Anthropic, PBC (Claude models), through its commercial API. Anthropic's commercial terms do not allow it to train models on data we send, and it keeps that data only for a short period for operating the service and preventing abuse.
• What the AI sees: only what a task needs: for example one document, a list of transactions to categorise, or one month's reports. We do not send your whole ledger history in one go.
• People stay in charge: categories the AI is highly confident about may be posted to your books automatically and can be reviewed and corrected at any time. Anything flagged as unusual (owner drawings, transfers, loans, refunds, payments to individuals, possible equipment purchases, unusual amounts, anything needing a split) goes to a person. Bills are recorded only after approval. Your monthly report is checked by a person before it is sent. The AI never pays bills, moves money, gives tax or legal advice, or makes decisions about you that have legal or similarly significant effects.
• Your choices: you can ask us which entries were posted automatically, and you can ask us to switch off automatic posting so that every AI suggestion is reviewed by a person first (turnaround may be slower).
• No other AI tools for your data: your financial records are never put into free or consumer AI tools. We use a separate AI provider (Groq) only for our own marketing content and to sort and draft replies to sales enquiries from people who are not yet clients. Emails from existing clients bypass it and go straight to a person, and it never receives your financial records or documents.

If we want to add or change an AI provider that processes your data, we will tell you first under section 6.

5. Confidentiality and security

• Only people who need your data to deliver the service can access it, and they are bound by confidentiality. Today that is the owner, Daniyal Paracha. Any future staff or contractor gets their own login and only the access their role needs.
• We access your books only through the accountant invitation or app connection you grant, and you can revoke it at any time.
• Our safeguards include encrypted connections (HTTPS/TLS), encrypted storage of keys and tokens, one-time sign-in links for the client portal (no passwords), identity checks handled entirely by Stripe, limited retention of automation run data, and failure alerts on every automated workflow.

6. Subprocessors

You authorise us to use the service providers below. Each is bound by written terms that protect your data at least as well as this DPA requires. We remain responsible for them.

We will email you at least 30 days before adding or replacing a subprocessor that handles your data. If you object for a reasonable data-protection reason and we cannot resolve it, you may end the affected services without penalty before the change takes effect.

7. Where your data is processed

Your books stay in your accounting provider's systems. Our automations run on n8n Cloud servers in the European Union, and our other providers mainly process data in the United States. Cypher's own team works remotely, including from Pakistan, and accesses your data from there only through the secure services listed above; we do not keep copies of your records on local computers beyond what a task needs. We apply the same protections wherever your data is accessed.

8. Incidents

If we become aware that your data has been, or is likely to have been, accessed, disclosed, changed or lost without authorisation, we will contain it promptly and notify you in writing within 72 hours of confirming it, or sooner if the law requires. We will tell you what happened, what data was involved, what we have done and what you should do, and we will cooperate with any notices you need to give.

9. Helping you

We will help you respond to requests from individuals (for example a request to access or delete their data), and with any reasonable questions from regulators, your auditors or your CPA about how we handle your data. On request (no more than once a year unless there has been an incident) we will give you a written summary of our security measures and subprocessors.

10. Keeping and deleting data

• While you are a client, we keep working records only as long as they are useful for your service.
• Within 30 days after your services end, we remove our access to your accounting system, disconnect our automations and delete or anonymise your working records, and confirm this to you in writing. You can ask for a copy of your working records before then.
• We keep billing records and correspondence that we are legally required to keep, or that we need for tax or dispute purposes, for up to 7 years, and we protect them under this DPA for as long as we hold them. Identity-check results are kept for the same period; the underlying ID data is kept by Stripe under its own retention terms.
• Your accounting records stay in your own QuickBooks Online or Xero company. They are yours.

11. Your responsibilities

You confirm that you are allowed to give us the data you send (including data about your customers, vendors and employees) for these purposes, that you will tell people about this where the law requires, and that you will not send us passwords, Social Security numbers, full account numbers or ID documents by email.

12. Changes, term and contact

• This DPA lasts for as long as we process your data. Its limits of liability are those in the Terms of Service.
• We may update this DPA to reflect changes in law or in our service. We will email you at least 30 days before a change that reduces your protections. Each version has a date at the top, and we record which version you accepted.
• Questions or concerns about your data: information@cypheroutsourcing.com · (973) 651-3210.