Data Processing Addendum
Last updated November 2, 2026
This Data Processing Addendum ("DPA") is part of the Terms of Service between Accred Products, LLC ("Accred", processor or service provider) and the Customer (controller or business). It applies whenever Accred processes personal data in Customer Data. No signature is needed; email hello@accredconsulting.com for a countersigned copy.
1. Roles and instructions
The Customer is the controller and Accred is the processor of personal data in Customer Data. Accred processes it only to provide the Services and on the Customer’s documented instructions: the Terms, this DPA, and the Customer’s use and configuration of the Services. Accred will tell the Customer if it believes an instruction breaks data protection law.
2. Details of processing
| Item | Description |
|---|---|
| Subject matter and duration | Providing the Services for the term of the agreement. |
| Data subjects | Customer users; the Customer’s clients and their contacts; users and devices in Microsoft 365 tenants the Customer connects; people whose personal data appears in content the Customer migrates or backs up. |
| Personal data | Names, email addresses, roles; directory and account attributes; device identifiers and inventory; ticket, project, and time records; assessment answers and evidence; phishing simulation and training results read with Accred Aware, and the recipients of simulations the Customer launches from it; audit log entries; content the Customer migrates with Accred Migrate (mail, files, sites, and Teams content) or backs up with Accred Protect (Exchange Online mail and OneDrive files), with its metadata. |
| Special categories | None intended. The Customer should not upload special-category data. |
| Purpose | Hosting, processing, securing, and supporting the Services. |
3. Accred’s obligations
- Bind everyone with access to confidentiality.
- Apply the security measures described on the Security page and in Annex A below.
- Help the Customer respond to data subject requests and with impact assessments and regulator consultations, where reasonable.
- Notify the Customer without undue delay, and within 72 hours, after confirming a personal data breach affecting Customer Data, with the information then available.
- Delete Customer Data within 30 days after the agreement ends, unless the law requires retention.
- Roll off Accred Protect backups under the retention period the Customer sets (30, 90, or 365 days, or 7 years): a backed-up version is deleted once it has been replaced or deleted in Microsoft 365 for longer than that period, the latest version of an item that still exists is kept, and stored content that no remaining version uses is permanently deleted after a 24-hour grace period.
- Provide information reasonably needed to show compliance, including answers to security questionnaires. Where that is not enough, the Customer may audit once a year with 30 days’ notice, at its cost, under confidentiality.
4. Subprocessors
The Customer authorizes the subprocessors on our Subprocessors page. Accred will give at least 30 days’ notice before a new subprocessor starts processing personal data, by updating that page and emailing the Owners of every Accred organization. The Customer may object on reasonable data protection grounds; if we cannot resolve it, the Customer may terminate the affected Services for a prorated refund. Accred stays responsible for its subprocessors.
5. International transfers
Where personal data from the EEA or Switzerland is transferred to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor) and, where the Customer is itself a processor, Module Three, incorporated by reference. Clause 7 (docking) applies; Clause 9 option 2 (general authorization, 30 days’ notice); Clause 11 optional language does not apply; Clause 17 and 18: Irish law and courts. Annex I is section 2 of this DPA; Annex II is Annex A; Annex III is the Subprocessors page. For UK transfers, the UK International Data Transfer Addendum applies, incorporated by reference.
6. US state privacy laws (CCPA/CPRA)
Accred is a service provider. It will not sell or share personal information, will not retain, use, or disclose it outside the direct business relationship or for any purpose other than providing the Services, will not combine it with other data except as the law permits, and will notify the Customer if it can no longer meet these obligations.
Annex A: Technical and organizational measures
- Hosting on Cloudflare; databases on Supabase and Accred Protect backups on Cloudflare, encrypted at rest; HTTPS for all traffic.
- Migrations run on the Migrate runner, a worker Accred operates; files bound for SharePoint and OneDrive are staged briefly in Accred’s Microsoft Azure storage. Connect devices check in through the Connect relay, which Accred operates on a DigitalOcean server behind Cloudflare; remote sessions are coming soon.
- One sign-in through Accred Hub, role-based access, and database rules that scope records to each organization.
- An administrative audit log in Hub.
- Read-only Microsoft discovery in Assess. Read-only scans, prechecks, and validation in Migrate; migration runs write to the destination tenant, and Migrate changes the source tenant only through explicit Cutover steps. Tenant changes in Manage shown before they run and logged; Manage can remove access: onboarding, offboarding, and access-review removals need a second Owner or Admin to approve, and a single change, such as removing one group member, runs after a confirmation.
- Least-privilege access for Accred personnel, and secrets kept out of source code.
- Payment card data handled by Stripe and never stored by Accred.