Data Processing Agreement — Review Draft
USProFin Systems LLC · October 19, 2026
Not yet binding
This is informational and is not an executed DPA. A binding agreement requires signed or otherwise valid acceptance of approved terms and annexes.
Roles and instructions
Where the firm determines the purposes of its client records, it generally acts as controller and USProFin Systems LLC as processor, as applicable under law. Processing instructions must be documented.
Safeguards and incidents
The binding DPA should cover confidentiality, least-privilege access, tenant isolation, incident notification, audit support, deletion and return of information.
Vendors and locations
Current infrastructure includes US-region Supabase and Vercel resources. Actual backup locations, AI providers and other subprocessor data flows must be verified; planned company-owned servers are not yet active.
Vendor W-9 records in the client portal
When a firm uses the client portal to request Forms W-9, the data subjects include the vendors of the firm's clients. The data are the W-9 fields, the taxpayer identification number (encrypted in the application), the electronic signature evidence and an image of a government-issued photo ID of the person signing (sensitive data, stored securely and never sent to AI or used for face matching). Recipients are the firm's authorized users and the client's portal users, who see a copy with the last 4 digits and can download a complete copy with multi-factor authentication. On the firm's instructions, W-9 data and the ID image are kept 12 months from submission; the client and the firm are warned 60 and 15 days before, and an authorized person of the firm confirms the deletion, which is logged. Files are stored with our storage sub-processor (Supabase, US region). An incident affecting ID numbers or taxpayer identification numbers is notified as the binding DPA and the law require.
Execution
Request the legally reviewed, signable DPA, vendor list and annexes from support@ledgeroncue.com. No unverified US-only guarantee is made here.