Tämä asiakirja on toistaiseksi saatavilla vain englanniksi.
Data Processing Agreement
EntrepreJee Last updated: 19 August 2026
This Data Processing Agreement ("DPA") forms part of, and is incorporated by reference into, the Terms of Service between you ("Controller", "you") and Heino Digital ("Processor", "EntrepreJee", "we"). It applies whenever you enter personal data about your own customers or contacts ("Customer Personal Data") into the Service. It reflects the requirements of Article 28 of the EU General Data Protection Regulation (2016/679, "GDPR").
1. Definitions
Terms such as "personal data", "processing", "controller", "processor", "data subject", and "personal data breach" have the meanings given in Article 4 GDPR. "Customer Personal Data" means personal data relating to your customers, contacts, or other third parties that you or your users submit to the Service, as distinct from your own account and business-profile data (which EntrepreJee processes as controller under the Privacy Policy).
2. Roles
You are the controller of Customer Personal Data. EntrepreJee is the processor, acting only on your documented instructions as set out in this DPA and as given by your use of the Service's ordinary functionality (e.g. creating a customer record, generating an invoice).
3. Subject matter, duration, and nature of processing
- Subject matter: hosting, storage, and processing of Customer Personal Data as necessary to provide the Service (customer relationship management, invoicing, quoting, time tracking, document generation, and related reporting).
- Duration: for as long as your subscription is active, and thereafter only as needed to comply with section 9 (data return and deletion) and any statutory retention obligations described in the Privacy Policy.
- Nature of processing: storage, retrieval, structuring, and display of Customer Personal Data within the Service; no processing occurs outside what is needed to provide the Service to you.
4. Categories of data subjects and personal data
- Data subjects: your customers, clients, and other contacts that you choose to record in the Service.
- Categories of personal data: name, email address, phone number, postal address, free-text notes, and any personal data contained in invoices, quotes, time entries, or documents you create (e.g. billing details, project descriptions).
We do not require or expect you to submit special categories of personal data (Article 9 GDPR, e.g. health or biometric data) into the Service, and you should not do so.
5. Processor obligations
EntrepreJee will:
- Process Customer Personal Data only on your documented instructions, including regarding international transfers, unless required to do otherwise by EU or Member State law (in which case we will inform you first, unless prohibited from doing so).
- Ensure that personnel authorised to process Customer Personal Data are bound by confidentiality obligations.
- Implement appropriate technical and organisational measures under Article 32 GDPR, including encryption of data at rest and in transit and database-level access control (row-level security) that restricts each customer's data to that customer's own account, as described in the Privacy Policy.
- Taking into account the nature of the processing, assist you by appropriate technical and organisational measures, insofar as reasonably possible, in fulfilling your obligation to respond to data subject rights requests. Where your customer contacts us directly about their data, we will redirect them to you and support you in responding.
- Assist you in ensuring compliance with your obligations under Articles 32–36 GDPR (security, breach notification, data protection impact assessments), taking into account the information available to us.
- Notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.
- At your choice, delete or return all Customer Personal Data after the end of the provision of the Service, and delete existing copies, except where EU or Member State law (e.g. bookkeeping retention obligations) requires storage of that data.
- Make available to you the information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by you or an auditor mandated by you, on reasonable notice.
6. Technical and organisational measures
Under Article 32 GDPR and section 5.3 above, EntrepreJee implements the following technical and organisational measures ("TOMs") to protect Customer Personal Data. This is a factual snapshot, not a certification. Rows below describing a measure that is not yet in place say so plainly, as a gap — not hedged as a pending decision — and should not be read as implying a safeguard exists until the row says it does.
| Category | Measure | Status |
|---|---|---|
| Physical security | Data-centre physical security | Inherited from our cloud sub-processors, Supabase and Vercel — both are independently SOC 2 Type II and ISO 27001 certified in their own right, which covers physical and facility security at the data-centre level. See each provider's own published compliance documentation for details. |
| Cloud hosting | Application and database hosting | Application hosted on Vercel Inc.; database, authentication, and file storage hosted on Supabase (managed PostgreSQL). See section 7 (Sub-processors) and the Privacy Policy for the current provider list. |
| Restricted access | Who can access production data | Limited to the business owner, who is currently the sole individual holding any production infrastructure credentials — no other person has access to the underlying Supabase or Vercel dashboards, so there is no additional individual whose access would need a formal review or revocation process. The same Supabase project serves as both the production database and the ongoing development/test environment (a deliberate decision, not an oversight — see TODO.md's "Production database" item); a fully separate testing database remains a deferred future item, not a current gap in production access control. |
| Network security | HTTPS | Enforced for all application traffic by our hosting provider. |
| TLS | Enforced for all connections to the database (Supabase). | |
| Firewalls | Provided by our cloud sub-processors' infrastructure by default. EntrepreJee does not configure any additional custom firewall or web-application firewall of its own beyond what Supabase and Vercel include. | |
| Database | Row-level security | In place and enforced at the database level: PostgreSQL row-level security policies scope every business's data (customers, invoices, quotes, products, expenses, documents, etc.) to that business's own members, keyed off the authenticated user — not just application-level filtering. |
| Encryption at rest | Provided by Supabase's underlying infrastructure by default — not implemented separately in EntrepreJee's own application code. | |
| Encryption in transit | Enforced via TLS on all connections between the Service and the database. | |
| Authentication | Secure authentication | User authentication is handled by Supabase Auth (session management, email verification, password reset flows) rather than custom-built authentication code. |
| Password hashing | Passwords are hashed (bcrypt) by Supabase Auth; EntrepreJee never stores or has access to plaintext passwords. | |
| Access control | Least privilege | Enforced at the application/data level via row-level security plus a three-tier role model (owner / user / viewer) that limits what each team member of a business can view, edit, or delete. Least-privilege access to production infrastructure itself is inherently satisfied while only one individual (the business owner) holds any production credentials — see "Restricted access" above. |
| Admin access logging | Implemented. Every successful sign-in is recorded (user, business, IP address, browser/device information, timestamp) in a dedicated login_events table, readable only by the business owner (enforced at the database level via row-level security) and automatically deleted after 60 days. See internal_docs/ACCESS_LOGGING.md for the design and TODO.md's "User access / IP logging" entry for status. This does not cover per-record data-access auditing (e.g. who viewed a specific invoice) — only authentication events, matching the scope of the original gap. |
|
| Payments | Customer invoice payments | A business may optionally connect its own Stripe account (Stripe Connect Express) to accept online card payment on its own invoices via the customer portal. Payment funds settle directly into the business's own connected Stripe account, not into an EntrepreJee-held account — EntrepreJee's platform account never custodies a business's customer payments. Stripe remains the sub-processor handling the actual card data end to end, same as for EntrepreJee's own plan billing (see section 7). |
| Monitoring | Error logging | Minimal — currently limited to our hosting provider's default runtime/function logs; no dedicated error-tracking service (e.g. Sentry) is integrated. This is a known, currently unresolved gap. |
| Intrusion monitoring | Not yet implemented. No intrusion detection/monitoring tooling is in place. | |
| Backup | Daily backups | Not currently provided at the infrastructure level. The production database runs on Supabase's Free tier, which does not include an automated backup or point-in-time-recovery guarantee. This is a known, unresolved gap — see TODO.md's "Production database" item — and should be closed (e.g. by upgrading to a paid Supabase tier with backups, or implementing an independent backup process) before this row can describe an actual backup safeguard. |
| Disaster recovery | Not yet implemented. No documented disaster-recovery plan (e.g. restore-time objectives, tested recovery procedure) exists yet. |
Do not represent any "not yet implemented" item above as an existing safeguard to a customer or auditor until it is genuinely in place — this table should be updated in the same change that resolves each gap, the same way the rest of this document must stay accurate to reality (see the note at the end of this document).
7. Sub-processors
You provide general authorisation for EntrepreJee to engage the sub-processors listed in section 6 of the Privacy Policy for the purposes described there. We will keep that list up to date and will inform you of any intended addition or replacement of a sub-processor, giving you the opportunity to object on reasonable data-protection grounds. Any sub-processor we engage will be bound by data protection obligations no less protective than those in this DPA.
8. International transfers
Where a sub-processor is located outside the European Economic Area, transfers of Customer Personal Data to it will be governed by the European Commission's Standard Contractual Clauses or another valid transfer mechanism under Chapter V GDPR, as described in the Privacy Policy.
9. Data return and deletion on termination
On termination of your subscription, and subject to statutory retention obligations described in the Privacy Policy, we will delete Customer Personal Data within a reasonable period. You can export your customer, invoice, and document data from within the Service before terminating your account.
10. Liability
Liability under this DPA is subject to the limitation of liability set out in section 15 of the Terms of Service.
11. Governing law
This DPA is governed by the laws of Finland, consistent with section 18 of the Terms of Service.
12. Contact
Questions about this DPA can be sent to support@heinodigital.fi.
This document is not legal advice, and is not a substitute for a qualified Finnish/EU lawyer's review of your specific situation — particularly sections 5–9, which carry real contractual obligations (audit rights, breach notification timelines, sub-processor lists) that must match what we can actually operationally deliver. Section 6 (Technical and organisational measures) is kept factually accurate as of the date above, including where it states a measure is not yet in place — see that section for the current, honest state of our safeguards.