Data processing addendum
The addendum FinBoss signs with every paying firm. It sits under the order form and governs how FinBoss processes the firm's data.
Template, version 2026.09. Under review by counsel before the first paid agreement; until then it describes our intended terms and is not an executed contract.
1. Parties and roles
The firm (the “Customer”) is the controller of, and remains responsible for, the personal information of its clients and prospects that it puts into FinBoss (“Customer Data”). FinBoss AI (the “Provider”) is a processor and service provider that processes Customer Data only on the Customer's documented instructions, which are the product's functions as configured by the Customer, this addendum and the order form.
2. Scope of processing
Customer Data includes household and contact records, financial profile facts and account balances the Customer enters, documents the Customer uploads, meeting notes and transcripts, communications sent through the platform, and the derived artifacts (briefs, summaries, drafts, scenarios). Processing consists of storage, retrieval, generation of drafts and summaries with the assistance of language models, delivery of approved communications, and the audit and archive functions described on the AI use and controls page.
3. Instructions and restrictions
The Provider will not sell Customer Data, share it for cross-context advertising, use it to train models, or process it for any purpose other than providing the service. The Provider will inform the Customer if it believes an instruction violates applicable law, including Regulation S-P and the state privacy laws that apply to the Customer.
4. Security measures
The Provider maintains, at a minimum: encryption in transit (TLS 1.2 or higher) and at rest; tenant isolation enforced in the database with row-level security and an automated isolation test suite on every schema change; role-based access with least privilege; multi-factor authentication for privileged roles; integration credentials held in a vault and never logged; an append-only, hash-chained audit log; point-in-time recovery with a documented restore drill; vulnerability management of dependencies; and no standing access by Provider staff to Customer Data, with any break-glass access time-boxed, logged and notified to the Customer.
5. Subprocessors
The Provider may engage the subprocessors listed on the Subprocessors page. The Provider will give the Customer at least 30 days' notice before adding a subprocessor that will process Customer Data; the Customer may object on reasonable grounds, and if the objection cannot be resolved the Customer may terminate the affected service without penalty. The Provider remains responsible for its subprocessors' performance.
6. Personnel and confidentiality
Provider personnel with access to Customer Data are bound by confidentiality obligations and receive security training. Access is reviewed at least quarterly and removed on role change or departure.
7. Security incidents
The Provider will notify the Customer of a confirmed security incident affecting Customer Data without undue delay and no later than 72 hours after confirmation, with what is known about the nature of the incident, the data and clients affected, the likely consequences and the measures taken. The Provider will cooperate with the Customer's own notification obligations, including those under Regulation S-P and state breach laws, and will not notify the Customer's clients directly unless required by law or agreed with the Customer.
8. Assistance
The Provider will assist the Customer in responding to client requests to access, correct or delete personal information, to regulatory examinations and to due-diligence questionnaires, by providing exports, the audit log, the communications archive and the documentation on these pages.
9. Retention and deletion
Customer Data is retained for the life of the agreement and per the retention classes the Customer configures, which cannot be set below the regulatory floors that apply to books and records. On termination the Customer may export all Customer Data (structured records as JSON, artifacts and the archive as PDF, files as uploaded) for 30 days, after which the Provider deletes Customer Data within 90 days, except copies retained in backups until their scheduled expiry and records the Provider must keep by law. A certificate of deletion is provided on request.
10. Audit
The Provider will make available the information necessary to demonstrate compliance with this addendum, including third-party audit reports once available (SOC 2), penetration test summaries, and this documentation. On reasonable notice, no more than once a year unless following an incident, the Customer or a regulator may audit the Provider's processing under confidentiality.
11. Data location and transfers
Customer Data is stored and processed in the United States. The Provider does not transfer Customer Data outside the United States except as listed for a subprocessor on the Subprocessors page.
12. Term
This addendum applies for as long as the Provider processes Customer Data and survives termination of the order form until deletion is complete. In a conflict between this addendum and the order form regarding the processing of Customer Data, this addendum controls.