Data protection & security
Your clients' files, kept like they're ours to lose.
Accounting and law firms hold some of the most sensitive files people own. This page explains how the systems we build handle them. It's a summary; the binding version is the Data Processing Addendum in our Master Service Agreement.
Roles
Your firm is the controller. We're your processor, and we act only on your instructions. For US firms we act as a service provider and contractor: we don't sell or share personal information, and we support your duties under the FTC Safeguards Rule, IRC section 7216, and bar or professional confidentiality rules.
How data is protected
- Encryption in transit (TLS) on every page and API, and encryption at rest by the hosting and storage providers.
- Uploads go to private storage and are opened only through short-lived signed links.
- Each firm gets its own environment. Demos and tests never use real client data.
- Admin accounts use multi-factor authentication and least-privilege access. Secrets live in encrypted environment settings, never in code.
- We don't look inside client files except to build, support or fix the system, and we never use them to train AI.
- Updates and dependency patches are applied under the Care plan.
Subprocessors
| Who | Where | Why |
|---|---|---|
| Vercel Inc. | USA (region chosen per client: US, EU or UK) | Hosting, functions, private file storage |
| AI provider (xAI or OpenAI, named in your Order Form) | USA | Document checks, only if AI is switched on |
| E-signature provider (if used, named in your Order Form) | Varies | Engagement letters and signatures |
| Google (Gmail) | USA | Our support email |
| Dodo Payments | Merchant of record | Your firm's billing with us (not your clients' data) |
We give 14 days' notice of any new subprocessor, and you can object.
International transfers
We work from India. For data from the EEA we use the EU Standard Contractual Clauses (Module 2), and for UK data the UK International Data Transfer Addendum. Both are built into our agreement. Hosting can sit in an EU or UK region.
If something goes wrong
If we become aware of a personal data breach affecting your data, we tell you without undue delay, and within 48 hours at the latest, with what we know and what we're doing about it, so you can meet your own notification deadlines.
Export and deletion
You can ask for a full export at any time (CSV/JSON plus the original files). When you leave, we delete your data from systems we control within 30 days of you confirming the export, and we confirm in writing.
Questions or a security questionnaire?
Send it to hello@work.kingdomofkumar.com. We'll answer it in writing.