Data Processing Addendum
Last updated October 21, 2026
This Data Processing Addendum ("DPA") is part of the Terms of Service between Accred Products, LLC ("Accred", processor or service provider) and the Customer (controller or business). It applies whenever Accred processes personal data in Customer Data. No signature is needed; email hello@accredconsulting.com for a countersigned copy.
1. Roles and instructions
The Customer is the controller and Accred is the processor of personal data in Customer Data. Accred processes it only to provide the Services and on the Customer’s documented instructions: the Terms, this DPA, and the Customer’s use and configuration of the Services. Accred will tell the Customer if it believes an instruction breaks data protection law.
2. Details of processing
| Item | Description |
|---|---|
| Subject matter and duration | Providing the Services for the term of the agreement. |
| Data subjects | Customer users; the Customer’s clients and their contacts; users and devices in Microsoft 365 tenants the Customer connects. |
| Personal data | Names, email addresses, roles; directory and account attributes; device identifiers and inventory; ticket, project, and time records; assessment answers and evidence; audit log entries. |
| Special categories | None intended. The Customer should not upload special-category data. |
| Purpose | Hosting, processing, securing, and supporting the Services. |
3. Accred’s obligations
- Bind everyone with access to confidentiality.
- Apply the security measures described on the Security page and in Annex A below.
- Help the Customer respond to data subject requests and with impact assessments and regulator consultations, where reasonable.
- Notify the Customer without undue delay, and within 72 hours, after confirming a personal data breach affecting Customer Data, with the information then available.
- Delete Customer Data within 30 days after the agreement ends, unless the law requires retention.
- Provide information reasonably needed to show compliance, including answers to security questionnaires. Where that is not enough, the Customer may audit once a year with 30 days’ notice, at its cost, under confidentiality.
4. Subprocessors
The Customer authorizes the subprocessors on our Subprocessors page. Accred will give at least 30 days’ notice of a new subprocessor by updating that page and emailing organization owners. The Customer may object on reasonable data protection grounds; if we cannot resolve it, the Customer may terminate the affected Services for a prorated refund. Accred stays responsible for its subprocessors.
5. International transfers
Where personal data from the EEA or Switzerland is transferred to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor) and, where the Customer is itself a processor, Module Three, incorporated by reference. Clause 7 (docking) applies; Clause 9 option 2 (general authorization, 30 days’ notice); Clause 11 optional language does not apply; Clause 17 and 18: Irish law and courts. Annex I is section 2 of this DPA; Annex II is Annex A; Annex III is the Subprocessors page. For UK transfers, the UK International Data Transfer Addendum applies, incorporated by reference.
6. US state privacy laws (CCPA/CPRA)
Accred is a service provider. It will not sell or share personal information, will not retain, use, or disclose it outside the direct business relationship or for any purpose other than providing the Services, will not combine it with other data except as the law permits, and will notify the Customer if it can no longer meet these obligations.
Annex A: Technical and organizational measures
- Hosting on Cloudflare; databases on Supabase, encrypted at rest; HTTPS for all traffic.
- One sign-in through Accred Hub, role-based access, and database rules that scope records to each organization.
- An administrative audit log in Hub.
- Read-only Microsoft discovery in Assess; read-only scans, prechecks, and validation in Migrate; tenant changes in Manage shown before they run.
- Least-privilege access for Accred personnel, and secrets kept out of source code.
- Payment card data handled by Stripe and never stored by Accred.