Trust Center

Trust Center

One page that links every privacy, security, and compliance document EverCFO publishes. Use this page when a procurement or security team asks for “the trust page.”

Last updated: 2026-10-14

Published policies and contracts

Privacy Policy

What data we collect, how we use it, and the rights you have over it. Includes the GDPR Article 13/14 transparency information and, in section 5, how long we keep data: 30 days to export after account closure, deletion within 90 days, and two 7-year exceptions (billing and tax records, and the AI reasoning log with your identity removed).

Read /privacy →

Security

The five layers of protection between customer data and the outside world: authentication, encryption, tenant isolation, traceable AI, and the AI reasoning log per LOCK-030.

Read /security →

Sub-processors

Every third-party processor EverCFO engages (16 of them), plus the 2 disclosed ahead of first use and the ones we have removed, with role, data categories, storage location, and DPA links per row.

Read /subprocessors →

Data Processing Addendum

Draft DPA template covering GDPR Article 28 + UK GDPR obligations, including breach notification in section 8. Annex II lists the verified technical and organizational measures. A signed counterpart is available on request.

Read /dpa →

Cookie Policy

Which cookies and similar technologies EverCFO sets, why we set them, and the email + browser paths for opting out of analytics cookies.

Read /cookies →

Refund Policy

How cancellations and refunds work. Subscription fees are non-refundable except where required by law; discretionary credits apply in exceptional cases.

Read /refund-policy →

Terms of Service

The Master Service Agreement governing your use of EverCFO. Governing law: Quebec, Canada.

Read /terms →

Compliance posture

EverCFO publishes qualified statements about its regulatory posture rather than badge-style claims. Each statement describes the operational control or document EverCFO actually maintains today.

GDPR (EU)

EverCFO acts as Processor for Customer Personal Data under the Master Service Agreement and our DPA. Data subject rights are honored per /privacy section 7; sub-processor obligations are documented at /subprocessors. The draft DPA at /dpa covers GDPR Article 28 obligations including breach notification (without undue delay), audit rights, and Standard Contractual Clauses Module Two and Module Three flow-down.

UK GDPR

Where Customer Personal Data is subject to the UK GDPR, the UK Addendum to the EU SCCs (issued by the UK Information Commissioner's Office under Section 119A(1) of the UK Data Protection Act 2018) applies per the draft DPA Annex III. The UK Addendum is distinct from the stand-alone UK International Data Transfer Agreement.

CCPA / CPRA (California)

EverCFO is not currently a CCPA-threshold business per the California subsection of /privacy section 7 (we do not meet the 2025 California Consumer Privacy Act revenue, household, or data-broker thresholds). We extend the privacy rights described in /privacy section 7 voluntarily and will scale our CCPA program as the business reaches the threshold.

Quebec Law 25

EverCFO's primary place of business is Quebec, Canada. /privacy section 7 names the person responsible for the protection of personal information and explains how we notify the Commission d'accès à l'information and affected individuals of a confidentiality incident that presents a risk of serious injury. Section 8 of the draft DPA at /dpa sets out how we notify business customers. Both are designed to satisfy the Quebec Act respecting the protection of personal information in the private sector (Law 25).

PIPEDA (Canada)

The privacy contact described in /privacy and the breach notification set out in section 8 of the draft DPA at /dpa follow the guidance issued by the Office of the Privacy Commissioner of Canada under the Personal Information Protection and Electronic Documents Act (PIPEDA), including the as-soon-as-feasible breach notification standard.

SOC 2

EverCFO has not undertaken a SOC 2 audit. The engagement is deferred until our customer base justifies the audit. Until a SOC 2 report is available, customers may rely on the draft DPA's Annex II verified Technical and Organizational Measures (TOMs) and the published Service documentation for evidence of compliance.

HIPAA, PCI-DSS, ISO 27001

EverCFO does not handle Protected Health Information (PHI) and is not a HIPAA Covered Entity or Business Associate. Subscription charges are collected by the billing provider for the way a customer subscribed (Shopify for an App Store installation, or the payment provider listed at /subprocessors once direct billing is offered), and payment-card data is handled entirely by that provider. EverCFO never sees or stores card numbers, so PCI-DSS does not apply at the EverCFO layer. ISO 27001 is out of scope until the SOC 2 engagement above.

Engineering provenance

The sub-processor list and the DPA Annex II Technical and Organizational Measures are not marketing copy. Both are rendered directly from typed source-of-truth data. Regression tests pin their shape, and we run them before merging changes.

  • Sub-processor registry: 16 processors engaged today, plus 2 disclosed ahead of first use. Rendered at /subprocessors.
  • Verified Technical and Organizational Measures: currently 12 measures, each with a stable evidence pointer to a test, code path, or vendor-managed default. Rendered as Annex II of the draft DPA at /dpa.

Service status

EverCFO does not yet publish a public uptime dashboard. Internal uptime monitoring runs against the API health endpoint via BetterStack. A public status page will be linked here once it is available; in the meantime, please email support@evercfo.ai if you believe EverCFO is unavailable for your account.

Contact