Data Processing Addendum (DPA)

Bilan AI (operated by Dependable Property LLC). Version 2.4 · Last updated: 10/19/2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Dependable Property LLC ("Bilan AI", "Processor") and the customer ("Customer", "Controller") and applies to the processing of Personal Data by Bilan AI on behalf of the Customer. Where the GDPR, UK GDPR, or similar laws apply, this DPA governs such processing.

1. Roles of the parties

For Personal Data that the Customer submits to the Service about its own clients, employees, and contacts, the Customer is the Controller and Bilan AI is the Processor. Bilan AI is a Controller only for limited account-administration data described in the Privacy Policy.

2. Processing details

Subject matter: provision of the cloud accounting/ERP Service. Duration: the term of the subscription plus any retention required by law. Nature & purpose: hosting, storage, and processing of Customer Data to deliver the Service. Data subjects: the Customer's clients, vendors, employees, and contacts. Categories of data: contact details, financial and accounting records, and other data the Customer chooses to input.

3. Processor obligations

• Process Personal Data only on the Customer's documented instructions, including this DPA and use of the Service;
• Ensure personnel authorized to process Personal Data are bound by confidentiality;
• Implement appropriate technical and organizational security measures (Section 7);
• Assist the Customer, taking into account the nature of processing, in responding to data-subject requests and in meeting security, breach-notification, and impact-assessment obligations;
• Notify the Customer without undue delay, and in any event within 48 hours of becoming aware, of a Personal Data Breach affecting Personal Data processed on the Customer's behalf, as described below;
• At the Customer's choice, delete or return Personal Data at the end of the engagement, subject to legal retention requirements;
• Make available information reasonably necessary to demonstrate compliance and allow for audits, subject to confidentiality and reasonable notice.

Each breach notice describes, to the extent then known, the nature of the Personal Data Breach, including the categories and approximate number of data subjects and of personal data records concerned; its likely consequences; and the measures taken or proposed to address it, including measures to mitigate its possible adverse effects (GDPR Art. 33(3)). Where this information cannot all be provided at the same time, Bilan AI provides it in phases as it becomes available, without undue further delay, and gives the Customer reasonable assistance with the Customer's own notifications to supervisory authorities and data subjects. Bilan AI's contact point for security incidents is security@aibilan.com.

4. Subprocessors

The Customer authorizes Bilan AI to engage the subprocessors listed at /subprocessors. Bilan AI imposes data-protection obligations on subprocessors consistent with this DPA and remains responsible for their performance. Bilan AI will provide notice of new subprocessors and a reasonable opportunity to object.

5. International transfers

Where Personal Data is transferred from the EEA, UK, or Switzerland to a country without an adequacy decision, such transfers are made under the applicable Standard Contractual Clauses, which are incorporated by reference into this DPA.

6. Data-subject rights

Bilan AI will, to the extent legally permitted, promptly inform the Customer of requests from data subjects and will assist the Customer in fulfilling its obligations to respond.

7. Security measures (Annex)

• Encryption of data in transit (TLS) and access controls on data at rest;
• Role-based access control and multi-tenant data isolation (each company's data is scoped and isolated);
• Least-privilege administrative access and audit logging of sensitive actions;
• Regular backups;
• Vulnerability management and change-control processes.

Hosted on SOC 2 Type II-audited infrastructure, with controls designed to the SOC 2 criteria.

8. Execution

To execute a countersigned copy of this DPA for your organization, contact support@aibilan.com.