Data Processing Agreement
This agreement covers the personal data inside your accounting records. It is part of the Terms of Service.
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Cenqra Limited, Room 1001, 10/F, Tower B, New Mandarin Plaza, 14 Science Museum Road, Tsim Sha Tsui, Kowloon, Hong Kong (“Processor”, “Cenqra”) and the customer company that uses Cenqra Accounting (“Controller”). It takes effect when the Controller accepts the Terms of Service; no separate signature is needed.
1. Subject and duration
Cenqra processes personal data contained in the Controller’s accounting records only to provide the accounting service, for as long as the Controller’s company exists in the service, and then for the deletion period in section 9.
2. Nature and purpose
Hosting, storing, calculating, displaying, exporting and, on the Controller’s instruction, sending documents and filings (email, e-invoicing). Reading scanned documents with an AI service when the Controller uses Scan.
3. Data subjects and data
- Data subjects: the Controller’s customers and suppliers (and their contacts), employees and payees, and the Controller’s own users.
- Data: names, contact details, tax and registration numbers, bank details (IBAN, SWIFT), invoice and payment details, attachments, and for payroll: salaries, allowances, deductions, identifiers and social-security data. No special-category data is required by the service; the Controller should not upload it unless needed.
4. Controller’s instructions
Cenqra processes the data only on the Controller’s documented instructions, which are given by using the service and by this DPA. Cenqra will tell the Controller if it believes an instruction breaks the law.
5. Confidentiality
Anyone at Cenqra who can access customer data is bound by confidentiality. Access to production data is limited to CenqraCenqra’s owner and the people he authorises in writingrsquo;s owner and the people the owner authorises in writing, and is used only for support the Controller asks for or to keep the service running and secure.
6. Security measures
- Encryption in transit (HTTPS, HSTS) and at rest (host disk encryption; AES-256-GCM for two-step secrets and e-invoicing API keys).
- Database reachable only over the host’s private network.
- Logical separation of every company’s data, verified each release by an automated cross-company attack test over every API route.
- Password hashing (bcrypt), email confirmation, invitation-based access, role-based permissions and custom roles, activity log of changes, optional two-step sign-in that the Controller can require for its admins or all users, “sign out everywhere”.
- Rate limits on sign-in and account emails; security event log (180 days) and alerts for anomalies.
- Dependency vulnerability checks on every change and weekly update pull requests.
- Database backups kept by the host and overwritten as they expire.
7. Sub-processors
The Controller authorises these sub-processors: Railway Corporation (hosting, United States, San Francisco region), Resend (email delivery), Anthropic (document scanning and AI assistance, only when used), and the e-invoicing, payment and bank-feed providers the Controller chooses. Cenqra will give 30 days’ notice by email before adding or replacing a sub-processor; the Controller may object and, if no solution is found, end the service. (Paddle acts as an independent Merchant of Record for Cenqra’s own subscription payments and does not process the Controller’s accounting records.)
8. International transfers
Data is hosted in the United States. Transfers to the sub-processors above are covered by contractual safeguards, and the Controller is responsible for any additional transfer requirement of its own law that applies to its records.
9. Deletion and return
The Controller can export its data at any time and delete its company from Settings. After a 14-day waiting period (during which the owner can cancel), all company data is permanently deleted from the live database. Copies in backups are overwritten as the backups expire. After a trial or subscription ends the Controller can export for 90 days before deletion. Security event records are kept for 180 days, then deleted.
10. Assistance
Cenqra will help the Controller answer data subject requests (most can be done directly in the app: edit or delete contacts, employees and documents, subject to accounting-record rules), and with security, breach notification and impact assessments where reasonable.
11. Personal data breaches
Cenqra will notify the Controller without undue delay, and within 72 hours of becoming aware of a breach affecting its data, with what is known, the likely consequences and the measures taken.
12. Audits
Cenqra will make available the information needed to show compliance with this DPA (including its latest security test results) and allow reasonable audits on 30 days’ notice, at most once a year unless after a breach.
13. Liability and precedence
Liability is as set out in the Terms of Service. If this DPA and the Terms conflict on data protection, this DPA prevails.