1. Overview
Aqqrue is an AI-assisted accounting platform for US accounting and bookkeeping firms. Customers own their Customer Data. Primary hosting is in US-based AWS environments. This page summarizes the program described in the Data Processing Agreement, including Schedule 2. The Terms of Service and Privacy Policy apply alongside it.
2. Compliance and insurance
Aqqrue holds a current SOC 2 Type II report, renewed through an annual independent audit. The report and related security documentation are available to customers on request, subject to confidentiality and access restrictions, as described in the Data Processing Agreement.
Aqqrue's privacy and security program is compliant with the EU and UK General Data Protection Regulation (GDPR) and with the Health Insurance Portability and Accountability Act (HIPAA). An ISO/IEC 27001 certification audit is in progress; this page will be updated when the certificate is issued.
Aqqrue maintains cyber insurance with coverage of US $1 million.
3. Safeguards
- Encryption of Customer Data in transit and at rest, with controlled key management.
- Role-based access, limited privileged access, and SSO where supported.
- Logical separation between tenants, network protection, logging, and monitoring.
- Secure development, vulnerability assessment, and penetration testing.
- Point-in-time recovery for up to 35 days and geo-redundant weekly backups retained for up to 12 months.
No security program eliminates all risk. Any stated availability target, including 99.9%, is an operational objective unless an order expressly makes it a service commitment.
4. Production access
Authorized Aqqrue personnel in the United States and in other countries may access production data only when needed to operate the Services, investigate a customer issue, or follow an authorized instruction. That access is logged and covered by confidentiality obligations. A separate affiliated company is listed as a subprocessor only if it processes Customer Personal Data as its own legal entity.
5. AI and customer data
Customer financial records, uploaded documents, and prompts are not used to train Aqqrue's models or third-party foundation models. OpenAI and Anthropic process task-relevant prompts and documents under contractual zero-data-retention arrangements. Google (Gemini API) and Mistral AI process task-relevant prompts and documents on paid commercial API tiers whose terms prohibit using that data to train or improve their models; Aqqrue does not opt in to any provider's data-sharing or model-improvement program and runs no self-hosted or offline models. Zero retention at the providers that offer it does not remove Aqqrue's own storage, audit, or backup obligations.
The Services are not designed for tax-return preparation, Social Security Numbers, medical records, or full payment-card credentials. Those identifiers can appear incidentally in accounting documents. Customers should not submit them intentionally unless Aqqrue has authorized a supported workflow in writing.
6. Subprocessors
Customers authorize the providers below. A provider may receive only the data its function requires. Aqqrue gives at least 30 days' notice before a new subprocessor processes Customer Personal Data. A customer may object in writing within 15 days on reasonable, documented data-protection grounds. The objection and termination rights are in the Data Processing Agreement. The register is also at /subprocessors.
| Provider | Service purpose | Customer data access |
|---|---|---|
| Amazon Web Services (AWS) | Primary US hosting, database, object storage, and recovery infrastructure. | Infrastructure may store or process Customer Personal Data. |
| Cloudflare | Network delivery, routing, performance, and infrastructure security. | Requests and related network and technical metadata as needed. |
| OpenAI | AI model inference and document processing. | Task-relevant prompts and documents; zero retention and no model training. |
| Anthropic | AI model inference and document processing. | Task-relevant prompts and documents; zero retention and no model training. |
| Google (Gemini API) | AI model inference. | Task-relevant prompts and documents on the paid API tier; not used for model training. |
| Mistral AI | Document text extraction (OCR). | Task-relevant documents on the paid API tier; not used for model training. |
| PostHog | Product analytics and feature-usage telemetry. | Limited usage data; sensitive document content excluded from intentional analytics capture. |
| Sentry | Application error monitoring and diagnostics. | Limited operational metadata and error logs; sensitive financial content minimized. |
Google Analytics, where enabled, measures this marketing website. It is described in the Privacy Policy and is not a processor of a customer's books.
7. Incidents
Aqqrue will notify the customer without undue delay, and within 48 hours after becoming aware of a confirmed security incident affecting that customer's personal data. The notice describes what is known and is updated as the investigation continues. Report a suspected incident to security@aqqrue.com.
8. Deletion and recovery
Customers should export Customer Data before access ends. Self-service export covers the formats the product supports. Additional supported exports can be requested at contact@aqqrue.ai while the account is active.
After termination, Aqqrue deletes Customer Data from active production systems within 15 days, except where the law requires longer retention. Point-in-time recovery copies may remain for up to 35 days. Weekly geo-redundant backup sets may remain for up to 12 months. Those copies stay protected, are not used for ordinary processing, and expire on the backup schedule. If a backup is restored, deletion instructions are reapplied.
9. Contact
Security incidents and requests for the SOC 2 Type II report or other compliance documentation: security@aqqrue.com
Privacy and operational questions: contact@aqqrue.ai
Aqqrue Inc., a Delaware corporation
8 The Green, #13842, Dover, DE 19901, United States