Security

1. Data storage and handling

1.1 Operational data

BillCadence stores the Customer Data reasonably necessary to provide and support the Services while the relevant Account or Service remains active. Depending on Customer's configuration, this may include Customer and Authorized User information; downstream customer and billing contacts; products and prices; subscription terms and effective-dated changes; billing schedules; invoice, credit, payment, and transaction information; Connected-Service identifiers and authorization data; BillCadence Output; audit and security records; support content; and customer-specific AI inputs, outputs, embeddings, or similar artifacts.

BillCadence may retrieve information from and write information to Customer-selected Connected Services such as QuickBooks Online, Xero, ChartMogul, and other accounting, billing, payment, commerce, customer- relationship, subscription-analytics, revenue-reporting, or communications systems. BillCadence requests only the permissions and data reasonably necessary for the enabled functionality.

BillCadence may use internal software, infrastructure, APIs, and data- processing functionality also used by SaaSync's core integration platform. For an enabled ChartMogul integration, those components may retrieve, transform, map, classify, and synchronize applicable Customer Data and combine it with BillCadence configuration and metadata solely to improve integration accuracy and operation. The components are operated by the same legal entity, remain within BillCadence's contractual security and data-processing boundary, and must preserve Account-level logical separation and applicable access, retention, logging, and deletion controls.

1.2 Logs, webhooks, and temporary records

BillCadence may temporarily cache Customer Data, retain webhook payloads, record error responses, and maintain audit, application, and security logs to operate integrations, prevent duplicate actions, diagnose failures, secure the Services, and support Customers. These records may contain Customer Data. Access is restricted to authorized personnel with a business need, and retention periods are limited according to the purpose and documented retention schedule.

1.3 Account deletion and inactivity

When an authorized Customer administrator expressly deletes an Account or applicable data source, associated active operational Customer Data is promptly queued for production deletion and is ordinarily deleted within minutes. If an Account becomes inactive without an express deletion request, BillCadence may retain active operational Customer Data for up to 45 days to permit reactivation, export, and Account recovery. It is then scheduled for production deletion.

Residual copies may remain in encrypted backups for up to seven days and remain protected until deleted through the ordinary backup lifecycle. Limited Account, transaction, consent, security, dispute, and compliance records may be retained longer when reasonably necessary or legally required, with use restricted to those purposes.

1.4 Processing locations

BillCadence's primary application infrastructure and covered Customer Data at rest are hosted in Amazon Web Services facilities in the United States. Authorized subprocessors may Process Customer Data in the United States and other locations identified in the Subprocessor List. Applicable international-transfer safeguards are described in the Data Processing Addendum.

2. Data privacy and use

As between SaaSync and Customer, Customer Data remains Customer's data. SaaSync uses Customer Data to provide, operate, secure, maintain, and support the Services, follow Customer's documented instructions, and comply with the applicable agreement and law. SaaSync's controller-side processing is described in the Privacy Policy.

BillCadence does not sell Customer Data and does not use any information about Customers' customers—including identities, contact details, subscription information, invoices, payments, or other connected billing data—for advertising, audience matching, enrichment, lookalike modeling, or campaign attribution. It does not provide that information to Google, Meta, or another advertising partner for those purposes.

BillCadence does not use identifiable Customer Data to train a generalized, shared, or cross-customer BillCadence or third-party AI model unless the Customer separately and affirmatively authorizes that Processing in a written agreement identifying the data, purpose, and additional terms. Customer-specific AI artifacts are treated as Customer Data and isolated from other Customers.

BillCadence may use OpenAI or another disclosed AI subprocessor for Customer-directed AI-assisted features. Provider training is disabled for production Customer content. Provider-side retention may still apply for abuse monitoring, security, or required application functionality as disclosed in the Subprocessor List and Data Processing Addendum.

3. Encryption, authentication, and credentials

• Data in transit. BillCadence protects data in transit using TLS 1.2 or later.
• Data at rest. Production databases, logs, and backups containing covered Customer Data are encrypted at rest using AES-256-GCM or an equivalently strong industry-standard mechanism.
• Passwords. Passwords managed by BillCadence are not stored in readable form and are salted and hashed using a modern password-hashing function.
• Connected-Service credentials. OAuth tokens, API credentials, and similar secrets are encrypted at rest and access is restricted.
• Privileged authentication. Multifactor authentication protects production and administrative access.
• Payment-card data. Payment-card details used to pay BillCadence are provided directly to an authorized payment processor and are not intended to pass through or be stored on BillCadence infrastructure.

4. Infrastructure and network security

• Cloud infrastructure. Primary application systems operate in Amazon Web Services in the United States.
• Isolation. Production application resources operate within logically isolated cloud environments with network controls designed to restrict unauthorized access.
• Monitoring. BillCadence monitors application, software, infrastructure, error, and security behavior using established logging, monitoring, and alerting services.
• Environment separation. Production access and Customer Data are separated from development and test activities through access, configuration, and data-handling controls.
• Cloud assurance. AWS maintains certifications and assurance reports, including ISO 27001 and SOC reports, for applicable services and regions. Those reports support vendor assessment but do not independently establish BillCadence's compliance with any law or certification framework.

5. Access controls

• Access to production systems and Customer Data is limited to authorized personnel with a documented business need.
• Access is assigned according to least privilege, reviewed periodically, and removed when no longer required.
• Privileged access is protected by multifactor authentication and appropriate credential controls.
• Personnel with access to Customer Data are subject to confidentiality obligations.
• Administrative and material Customer Data actions are logged where appropriate to support investigation and accountability.
• Customer Accounts and Customer Data are logically separated.

6. Development and vulnerability management

• Change management. Changes are reviewed and deployed through controlled development and release processes.
• Security updates. Security patches and dependency updates are assessed and applied according to risk.
• Vulnerability scanning. BillCadence performs vulnerability scanning of the application and supporting infrastructure.
• Penetration testing. Qualified third parties conduct penetration testing at least annually.
• Remediation. Identified findings are triaged, tracked, and remediated according to severity and risk.
• Data minimization. New features, fields, integrations, logs, and AI flows are reviewed to limit Customer Data to what is reasonably necessary.

7. Resilience, backups, and recovery

BillCadence uses redundant cloud infrastructure and backup or recovery mechanisms designed to reduce interruption risk and restore availability after a technical incident. Encrypted backups are created daily and ordinarily retained for seven days. Recovery procedures are documented and tested periodically.

Deleted data is not restored into production except for a documented disaster-recovery need. If a backup restoration reintroduces data pending deletion, applicable deletion jobs must be reapplied.

BillCadence does not promise a particular uptime percentage, recovery-time objective, recovery-point objective, or service credit unless an Order expressly provides one.

8. Incident response

BillCadence maintains a documented incident-response process covering detection, investigation, containment, remediation, evidence preservation, internal escalation, Customer notification, and post-incident review. Upon becoming aware of a qualifying Security Incident, SaaSync will notify affected Customers without undue delay as required by the Data Processing Addendum and applicable law and may provide information in phases as it becomes available.

9. Vendors and subprocessors

SaaSync assesses vendors according to the nature of their services and data access. Subprocessors that Process Customer Personal Data must enter written agreements containing applicable confidentiality, security, privacy, assistance, incident, and deletion obligations. The Subprocessor List identifies approved providers, functions, processing locations, and relevant Customer Data. Subprocessor changes are governed by the Data Processing Addendum.

Customer-selected Connected Services are not necessarily BillCadence subprocessors. Their security and privacy practices are governed by the Customer's agreements with those providers unless BillCadence separately uses the provider to perform the Services on Customer's behalf.

10. Customer security responsibilities

Customers should:

• use strong, unique credentials and enable multifactor authentication when available;
• limit Authorized Users and Connected-Service permissions to what is necessary;
• review and remove access promptly when personnel or responsibilities change;
• configure invoice status, approval, automation, and delivery settings according to business risk;
• review BillCadence Output and audit activity at an appropriate frequency;
• avoid submitting payment-card data, health information, government identifiers, children's data, or other restricted data unless SaaSync has expressly agreed in writing; and
• notify BillCadence promptly of suspected unauthorized access, compromised credentials, or security concerns.

11. Contact

Report a suspected security issue or request additional security information through support@billcadence.com. Privacy inquiries may be sent to .