Data Processing Addendum
Effective October 17, 2026 · Version 2026-10-17
This Data Processing Addendum ("DPA") forms part of the Subscription Agreement between Akea HMS LLC ("Akea") and the Customer. It applies when Akea processes personal information contained in Customer Data on the Customer's behalf.
1. Roles and instructions
The Customer is the business (or controller) and Akea is the service provider (or processor) of personal information in Customer Data. Akea will process it only to provide the Services, on the Customer's documented instructions (which include the Agreement and the Customer's use and configuration of the Services), and as required by law. Akea will tell the Customer if it believes an instruction violates law.
2. Service-provider commitments
Akea will not: sell or share the personal information; retain, use or disclose it for any purpose other than the business purposes in the Agreement, or outside the direct business relationship with the Customer; or combine it with personal information from other sources except as the law permits for service providers. Akea will comply with obligations that apply to it under U.S. state privacy laws, give the same level of protection they require, and notify the Customer if it can no longer meet them. The Customer may take reasonable steps to stop and fix unauthorized use.
3. Confidentiality and personnel
Akea limits access to people who need it to provide the Services and who are bound by confidentiality obligations.
4. Security
Akea maintains reasonable safeguards appropriate to the nature of the data, including: encryption of data in transit (TLS) and at rest; logical separation of each customer's data with row-level access rules; role-based permissions and two-step sign-in; hashed passwords and PINs with password rules that block reuse; storing only the last four digits of bank, tax and employer ID numbers; tamper-resistant audit trails for financial entries and time punches; least-privilege access for Akea staff; and backups held by our hosting provider in the United States.
5. Subprocessors
The Customer authorizes Akea to use the following subprocessors, and Akea will impose data-protection terms on each that are at least as protective as this DPA:
Akea will give at least 30 days' notice of a new subprocessor by updating this page or by email. The Customer may object on reasonable data-protection grounds; if the parties cannot resolve it, the Customer may terminate the affected Services and receive a refund of prepaid fees for the remaining term.
- Supabase, Inc.: database, authentication, file storage and server functions (United States, AWS us-east-1).
- Render Services, Inc.: web application hosting (United States).
- Anthropic, PBC: AI model processing for the AI assistant (United States).
- Postmark (ActiveCampaign, LLC): transactional email, when enabled (United States).
- Plaid Inc. or Finicity Corporation (a Mastercard company): bank-data connections, only when the Customer connects a bank (United States).
- Intuit Inc.: QuickBooks Online sync, only when the Customer connects QuickBooks (United States).
- 650 Industries, Inc. (Expo): mobile app builds and delivery of app updates (United States).
6. Security incidents
Akea will notify the Customer without undue delay, and in any event within 72 hours, after confirming a security incident that results in unauthorized access to or acquisition of the Customer's personal information, and will provide information reasonably available to help the Customer meet its own notification duties under state and federal law. Notifying the Customer is not an admission of fault.
7. Assistance and requests
Akea will provide reasonable help, taking into account the nature of the processing, for the Customer to respond to individuals' privacy requests and to complete any required risk assessments. Akea will forward to the Customer any request it receives directly about Customer Data.
8. Return and deletion
When the Agreement ends, Akea will return or delete Customer Data as the Agreement provides, except copies it must keep by law or that are in backups awaiting routine deletion, which remain protected by this DPA.
9. Audits
On written request no more than once a year, Akea will provide information reasonably needed to show compliance with this DPA, such as completed security questionnaires and summaries of its controls. Any on-site audit requires 30 days' notice, must be at the Customer's cost, during business hours, and under confidentiality terms.
10. Data location
Akea stores and processes Customer Data in the United States.
11. Liability
Each party's liability under this DPA is subject to the limitations of liability in the Agreement.
Contact
Akea HMS LLC
Phone: +1-469-253-2467
Email: info@akeahms.com
Other documents: all legal documents.