> ## Documentation Index > Fetch the complete documentation index at: https://docs.integrateledger.com/llms.txt > Use this file to discover all available pages before exploring further. # Data Processing Addendum > How Ledger processes personal data about your customers on your behalf, and the subprocessors it uses. **Effective date: November 8, 2026** This Data Processing Addendum ("DPA") is part of the agreement between The Monetization Company ("Ledger", "we") and you under the [Terms of Service](https://docs.integrateledger.com/terms.md). It applies when Ledger processes Customer Personal Data for you. You accept it when you accept the Terms of Service; no signature is needed. ## 1. Definitions * **Customer Personal Data** means personal data in Your Data, mainly about Your Customers and their users, that Ledger processes for you. * **Data Protection Laws** means the laws that apply to that processing, including the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and U.S. state privacy laws such as the California Consumer Privacy Act ("CCPA"). * "Controller", "processor", "data subject", "personal data", "personal data breach" and "processing" have the meanings in the GDPR. "Business", "service provider", "sell" and "share" have the meanings in the CCPA. ## 2. Roles You are the controller of Customer Personal Data, and Ledger is your processor (a service provider under the CCPA). Ledger is a controller only for information about the people who use the dashboard, which the [Privacy Policy](https://docs.integrateledger.com/privacy) covers. ## 3. Our obligations Ledger will: * process Customer Personal Data only on your documented instructions, which are the Agreement and your use of the Service, unless the law requires otherwise, in which case we'll tell you first if the law allows; * tell you if we believe an instruction breaks Data Protection Laws; * make sure everyone who processes it is bound by confidentiality; * protect it with the security measures in Annex 2; * help you, taking into account the nature of the processing, to respond to data subject requests and to carry out impact assessments and consultations with regulators; * forward to you any data subject request we receive about it, without answering it ourselves unless you ask us to. ## 4. Your obligations You will make sure you have a lawful basis for the processing, give Your Customers the notices the law requires, and send only the personal data the Service needs. Don't send sensitive data (section 5 of the Terms of Service). ## 5. Subprocessors You authorize Ledger to use the subprocessors in Annex 3. We have a written agreement with each that protects Customer Personal Data at least as well as this DPA, and we remain responsible for their work. We'll update Annex 3 at least 30 days before a new subprocessor starts processing Customer Personal Data, and email workspace owners who have asked for updates at [privacy@integrateledger.com](mailto:privacy@integrateledger.com). You may object on reasonable data-protection grounds within that period. If we can't resolve the objection, you may close your workspace. ## 6. Personal data breaches If we become aware of a personal data breach affecting Customer Personal Data, we'll tell you without undue delay, and within 72 hours, with what we know about it and update you as we learn more. We'll take reasonable steps to contain it. Telling you isn't an admission of fault. ## 7. International transfers Ledger stores Customer Personal Data in the United States. For transfers from the EEA, the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914 ("SCCs"), Module 2 (controller to processor), are incorporated into this DPA, with these choices: clause 7 (docking) applies; option 2 of clause 9(a) applies with the notice period in section 5; the option in clause 11(a) doesn't apply; clauses 17 and 18 choose the law and courts of Ireland; and Annexes 1 to 3 of this DPA complete the SCCs' annexes. For transfers from the UK, the UK International Data Transfer Addendum to the SCCs applies, and either party may end it as its section 19 allows. For transfers from Switzerland, the SCCs apply with references to the GDPR read as the Swiss law and the competent authority being the Swiss Federal Data Protection and Information Commissioner. If the SCCs conflict with this DPA, the SCCs win. ## 8. CCPA As your service provider, Ledger won't sell or share Customer Personal Data, keep, use or disclose it outside our direct business relationship with you or for any purpose other than providing the Service, or combine it with personal data from other sources except as the CCPA allows. We'll comply with the CCPA, tell you if we can no longer do so, and let you take reasonable steps to stop unauthorized use. ## 9. Audits We'll give you the information reasonably needed to show that we comply with this DPA, such as answers to security questionnaires. If that isn't enough, or a regulator requires it, you may audit our compliance once a year, at your cost, with 30 days' notice, during business hours, under confidentiality, and without access to other customers' data. ## 10. Deletion When the Agreement ends, we'll delete Customer Personal Data within 30 days after the export window in the Terms of Service, except for Live financial records we keep under section 10 of the Merchant Terms, or data the law requires us to keep. Data in backups is deleted as the backups expire. This DPA continues to apply to anything we keep. ## Annex 1: Details of the processing | | | | - | - | | Data exporter | You, as controller | | Data importer | The Monetization Company, 350 Sansome St, San Francisco, CA 94104, United States, as processor. Contact: [privacy@integrateledger.com](mailto:privacy@integrateledger.com) | | Data subjects | Your Customers and their users | | Categories of data | Customer IDs and any names, email addresses or metadata you send; Stripe customer, subscription and invoice identifiers; plans, credit balances and grants; usage events; billing amounts and dates; contact details in Stripe events about your Checkouts and invoices | | Sensitive data | None. You must not send it. | | Frequency | Continuous, for as long as you use the Service | | Nature and purpose | Hosting and processing to run your billing: keeping balances, recording usage, syncing your catalog and subscriptions with your Stripe account, sending you webhooks, support and security | | Duration | The term of the Agreement and the deletion period in section 10 | | Competent supervisory authority | The authority where you are established in the EEA, or, if you aren't, the authority of the EU representative you appoint | ## Annex 2: Security measures * Encryption in transit (TLS) for the dashboard, API and webhooks. Encryption at rest for the database through our hosting provider. * Stripe secret keys encrypted with a key held outside the database. Ledger API keys stored only as hashes. * Sandbox and Live data separated, and keys that only work in their own environment. * Dashboard sign-in through Clerk, with verified sessions, CSRF protection and reverification for sensitive actions. * Access to production limited to the people who need it, with multi-factor authentication on infrastructure accounts. * Request logs that leave out secrets and email addresses. Error reports that strip query strings. * Rate limits and bot protection in front of the API and sign-in. * Database backups, and a tested process for restoring them. * Dependency updates and secret scanning on the source repository. ## Annex 3: Subprocessors | Subprocessor | What it does | Location | | - | - | - | | Render Services, Inc. | Hosts the application, database and backups | United States (Oregon) | | Cloudflare, Inc. | DNS, network proxy, access control and bot protection; sees request metadata | Global network, United States | | Clerk, Inc. | Dashboard sign-in and user accounts | United States | | Functional Software, Inc. (Sentry) | Error monitoring | United States | | Axiom, Inc. | Request logs | United States (US East) | | Resend, Inc. | Sends account and notification email | United States | | Stripe, Inc. | Creates and runs the Stripe test accounts for Sandbox workspaces | United States | In Live, Ledger connects to your own Stripe account. Stripe processes those payments as your provider under your agreement with Stripe, not as Ledger's subprocessor. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.