Contact privacy@ownmybooks.com for a DPA applicable to your service. The information below explains the processing scope and protections to address in that agreement. It is not itself an executed DPA or a substitute for agreed service-specific terms, including subprocessor-change notice periods, fees and any required international-transfer clauses.
1. Scope, roles and instructions
A DPA supplements the Terms of Service and End User License Agreement for Sovereign Accounting Sync and applies to personal data Sovereign processes on a customer's behalf to provide that service (Customer Personal Data).
The customer determines its purposes and lawful instructions as controller; Sovereign acts as processor. If the customer is itself a processor for a client business, it must have authority to appoint Sovereign as a subprocessor and pass on that business's lawful instructions. Sovereign separately determines purposes for its account administration, business correspondence, legal compliance and website and marketing processing, as described in the Privacy Policy.
Documented instructions consist of the applicable agreement, DPA, Order and the customer's authorized service selections. Accounting-connection permissions do not authorize unrelated processing. Creating accounts and posting journals require separate human review and approval.
The DPA provides for Sovereign to inform the customer if an instruction appears to infringe applicable data-protection law and to suspend that instruction while the parties resolve it. Notice of legally required processing outside the instructions is given before processing unless the law prohibits notice.
2. Processing particulars
The service connects the desktop application to an accounting provider through a connector Sovereign hosts with Railway. Processing lasts for the service term and the applicable retention periods. Customer connections to live accounting data await accounting-provider approval.
Processing includes transient retrieval, validation and transmission of authorized records; connection maintenance; verification and readback; and retention of operational and identity records and account-setup information. Purposes include authorized company setup, chart mapping, employee matching and import review, account creation, approved journal transfers, troubleshooting, security, duplicate prevention and resolution of uncertain outcomes.
Data subjects can include authorized users, employees, client contacts, vendors and other people in the selected records. Information handled in the course of a request can include company names, addresses and employer identification numbers, employee profile information, and journal dates, accounts, amounts and descriptions. Accounting-provider responses can include more fields than the app displays, including records created before the connection. The connector receives full employee records, passes on only the profile information the review needs, and reduces a tax identification number to an indication that one exists. Employee-profile access is not payroll-history or year-to-date payroll import.
What the connector keeps is narrower: encrypted provider credentials and authorization material; connection, enrollment and access status; an operational record of each posting, reduced over time to an identity record kept for duplicate-posting protection; and account-setup information. These records contain business and transaction identifiers, processing status, and limited activity history needed to prevent duplicate entries and resolve processing errors. They stay linkable to the customer's business, and they do not contain an entry's amounts, descriptions, document number, posting accounts or employee details.
Response contents are not retained in connector storage or logs. Approved journals, mappings, account-plan details and detailed operation history remain in the desktop's encrypted company file. Local files enter Sovereign's processing scope only to the extent transmitted to a service or shared for support.
Automated agreement-acceptance recording is not currently enabled in the connector. The hosted connector records failed sign-in activity and limited security events; those records are described in the Privacy Policy and in Privacy and security updates.
For additional detail about the information stored for a particular service, contact privacy@ownmybooks.com.
3. Confidentiality, security and assistance
The DPA provides for people authorized to process Customer Personal Data to be bound by confidentiality and to access it only as needed. It calls for measures appropriate to the processing risk and no material reduction in overall protection during the term. Customers remain responsible for their devices, local administrators, permissions and independent copies.
It also provides for assistance, taking account of the processing and available information, with data-subject requests, security obligations, impact assessments and regulatory consultations. Requests about customer-controlled records are forwarded to the customer; those records are not independently disclosed or erased except on authorized instructions or as required by law. Identity and authority checks must be proportionate.
Contact privacy@ownmybooks.com to arrange the applicable assistance terms, including any fees. Mandatory legal duties are not displaced by fee arrangements.
4. Personal-data incidents
The notice standard is without undue delay after Sovereign becomes aware of a personal-data breach affecting Customer Personal Data, subject to applicable legal deadlines and any shorter binding contractual deadline. No universal numeric notification deadline is stated here.
Notice describes the breach, affected categories and approximate numbers of people and records, likely consequences, mitigation taken or proposed, and a contact for further information as those details become available. Initial notice is not delayed for a complete investigation; supplemental updates follow. The DPA provides for reasonable cooperation with containment and the customer's legally required notifications. Notification does not itself admit liability.
A processor's notice to its customer is separate from a controller's statutory deadline to notify authorities or individuals. Routine business-day support hours do not extend incident-notification deadlines.
The hosted connector records failed sign-in activity and limited security events, pauses repeated failed sign-ins and suspends unusual posting activity. Its alerts omit customer identifiers. Automated signals are not a claim of staffed monitoring. Our incident-response obligations under the applicable agreement, and the notice standard above, are unchanged. Report security concerns to security@ownmybooks.com.
5. Subprocessors
The applicable DPA identifies the subprocessors authorized for the Hosted Service. It must establish the advance notice and objection period for additions or replacements, how the parties seek a reasonable alternative after an objection on data-protection grounds, and the customer's right to end the affected service if no alternative is available. The treatment of prepaid unused fees must also be agreed. Those periods and financial terms are not set by this page.
The DPA addresses prompt notice and equivalent safeguards for emergency replacements, subject to applicable law. Sovereign remains responsible for delegated processing under the applicable DPA and imposes appropriate written obligations on subprocessors.
Railway is the current provider of the infrastructure the connector runs on. Its published DPA identifies Railway Corporation; the Subprocessor and Service Provider Register describes the data involved and available location information. An independently selected accounting provider is not automatically Sovereign's subprocessor. Jotform processes Sovereign website forms, and Stripe is selected for Sovereign subscription billing. Their inclusion in the broader register does not make them subprocessors of customer accounting data; role depends on actual purpose and instructions.
6. Return, deletion and audit
The subscription terms provide for full backup and export while the product subscription is active, before cancellation becomes effective. They do not offer an additional contractual post-cancellation product export window. Where data-protection law requires return or deletion at the customer's choice, that right remains available through the applicable request process; license expiry does not eliminate nonwaivable rights.
On a manual disconnect, the connector asks the accounting provider to revoke access, removes its copy of the customer's credentials and ends desktop access in the same request; an unresolved operation can defer completion, and scheduled cleanup removes the remaining connection information afterward. If the revocation does not succeed, the connector keeps retrying and still removes its own copy of the credentials.
The complete automated purge of connection credentials and connection information within 24 hours after the effective paid-period end or an earlier manual desktop disconnect is not fully deployed. There is no subscription-end deletion trigger, and an offline disconnect takes effect only when it reaches the connector. Unresolved operations and outages can delay cleanup. This page does not promise a current 24-hour deletion deadline.
The hosted connector runs cleanup on a schedule, including after a restart. It reduces finished operational records after the default 90-day period, or during disconnect cleanup, and deletes the resulting identity records 13 months after the operation; those identity records retain a protected fingerprint of the provider's company identifier rather than the readable identifier. An unresolved operation keeps its full record until the outcome is settled. Resolved account-setup plans are removed after 30 days; an authorization session expires after 10 minutes.
Older records may remain until the retention process has handled them, including readable company identifiers retained without a previous time-based limit. A deletion confirmation reports what was actually removed.
Retained information remains protected and restricted to its retention purpose. A deletion confirmation must distinguish completed deletion, backup copies awaiting expiry, retained operational identity records for duplicate-posting protection, and any legally retained categories. It must report actual retention rather than certify a planned limit. Disconnection cannot reverse completed accounting entries or erase customer-controlled files, exports, backups or copies held independently by an accounting provider.
The DPA provides for information reasonably needed to demonstrate compliance and audits, including inspections by the customer or an independent auditor under reasonable confidentiality and security arrangements. Ordinary audit notice, frequency and cost allocation must be agreed in the applicable DPA. Those arrangements must allow additional investigation after an incident or credible noncompliance and must not obstruct regulator access or mandatory rights. Audit materials must protect other customers' information. No certification or third-party audit report is promised.
7. International transfers, precedence and liability
Restricted international transfers require a valid mechanism under applicable law. Where needed, the parties must complete the appropriate EU Standard Contractual Clauses, UK Addendum or International Data Transfer Agreement, transfer assessment and supplementary measures for the actual parties and locations. This page is not a transfer mechanism or a set of Standard Contractual Clauses, and it does not promise U.S.-only processing.
An applicable DPA controls conflicts concerning Customer Personal Data; mandatory transfer clauses control conflicts within their scope. Liability follows the applicable Agreement except where mandatory law or transfer clauses require otherwise. Data subjects' nonwaivable rights remain unaffected.
Technical and organizational measures
Current safeguards include encryption of local company files and stored connection credentials, encrypted connections to the hosted service, and restrictions on service access.
The service can decrypt connection credentials to maintain authorized connections while the desktop app is closed. Local-file encryption does not prevent readable accounting data from passing through the connector. Administrative access is restricted; further access-control improvements are planned and are not represented here as completed safeguards.
The hosted connector separately protects each connection's stored credentials, ends desktop access when a disconnect completes, retires an earlier installation's access when the company reconnects, runs retention cleanup on a schedule, and records failed sign-in activity and limited security events. Abuse limits apply across the service's public routes, separately in its test and production environments. Automated signals are not a claim of staffed monitoring. Our incident-response obligations under the applicable agreement are unchanged.
Railway separately retains clear IP addresses and browser details in edge logs for about 30 days. See the Security Overview for the full current boundaries.
Contact directory
- DPA and privacy requests: privacy@ownmybooks.com; Privacy Office, Sovereign Software, LLC, PO Box 470, Wynne, AR 72396.
- Formal contractual notices: legal@ownmybooks.com; Sovereign Software, LLC, Attention: Legal Notices, PO Box 470, Wynne, AR 72396.
- Routine support: support@ownmybooks.com.
- Security and vulnerability reports: security@ownmybooks.com.