Subprocessors
These are the third-party providers that process client data on the Ledgerline audit platform, what each one does, and the terms that bind it. Ledgerline is a trade name of VectorPath Labs Inc.
Microsoft Corporation (Azure)
What it does. Cloud hosting of the Ledgerline audit platform: compute, document storage, key management and caching in the East US 2 region; the database in the Central US region.
Client data processed. All engagement data processed on the platform, including plan documents, census and payroll extracts, and workpapers.
Model training. Customer data is not used to train Microsoft models or for any purpose other than providing the services.
Retention and security. Encrypted in transit (TLS 1.2 or later) and at rest. SOC 2 Type 2 and ISO 27001. Retained until we delete it.
Contractual basis. Microsoft Product Terms and the Microsoft Products and Services Data Protection Addendum.
Microsoft Azure AI Document Intelligence
What it does. Reads client documents and extracts their text and tables within the audit platform (East US 2).
Client data processed. Plan documents, payroll and census files, and custodian statements submitted for extraction.
Model training. Inputs are processed to provide the service and are not used to train Microsoft models.
Retention and security. Transient processing within our Azure environment. Encrypted in transit and at rest.
Contractual basis. The same Microsoft Product Terms and Data Protection Addendum as hosting.
Microsoft Azure OpenAI Service
What it does. Language model used to read engagement documents and to propose memo drafts and review notes for the auditor, who checks every proposal against the source. Hosted and operated by Microsoft; no data is sent to OpenAI, L.L.C.
Client data processed. The extracted text of engagement documents, which can include participant-level data. Social Security number formatted values are masked before any result is stored.
Model training. Microsoft does not use prompts or outputs to train models, and does not share them with OpenAI.
Retention and security. Kept by Microsoft for up to 30 days for abuse monitoring, then deleted. Deployed through Microsoft’s Global Standard offering, under which Microsoft may process requests in any of its Azure regions; stored data stays in the United States. Encrypted in transit and at rest.
Contractual basis. Microsoft Product Terms, the Data Protection Addendum, and the Azure OpenAI service terms.
Microsoft Azure AI Foundry
What it does. Language model (Grok) used to map the summary lines of trust statements. Hosted and operated by Microsoft; no data is sent to xAI Corp.
Client data processed. Plan-level labels and dollar amounts only. No participant-level data.
Model training. Microsoft does not use prompts or outputs to train models, and does not share them with xAI.
Retention and security. Kept by Microsoft for up to 30 days for abuse monitoring, then deleted. Encrypted in transit and at rest.
Contractual basis. Microsoft Product Terms, the Data Protection Addendum, and the Azure AI Foundry service terms.
Finch (Tryfinch Inc.)
What it does. Payroll and HR data connector, used with the client’s authorization to retrieve census and payroll data.
Client data processed. Participant census and payroll data from the client’s payroll and HR systems.
Model training. Finch acts as a processor and handles employer and employee data only on our behalf. It states that it does not sell identifiable or anonymized employer or employee data and does not share it with third parties without explicit consent.
Retention and security. Data is erased from Finch’s systems when a connection is deactivated. TLS 1.2 in transit and AES-256 at rest. SOC 2 Type II audited.
Contractual basis. Finch’s privacy policy, security documentation and employer disclosures (tryfinch.com).
Hostinger International Ltd.
What it does. Email hosting for the ledgerlineaudit.com domain.
Client data processed. Client correspondence and documents sent or received as email attachments.
Model training. Not applicable: no model processing. Bound to confidentiality under its data processing agreement.
Retention and security. TLS encryption in transit; mailbox storage until deleted. Bulk client records move through the platform’s authenticated upload (login plus two-factor), not plain email.
Contractual basis. Hostinger’s terms of service and Data Processing Agreement.
Google LLC (Google Workspace)
What it does. Gmail for correspondence and Google Drive for document storage.
Client data processed. Client correspondence and shared documents, where used.
Model training. Customer data in Workspace services is not used to train generative models without permission, under the Google Workspace terms.
Retention and security. TLS in transit and encryption at rest; retention per our Workspace account settings.
Contractual basis. Google Workspace Terms of Service and the Cloud Data Processing Addendum.
Notes
- Each provider is bound to confidentiality and security terms that prohibit using client data for model training, consistent with AICPA Code of Professional Conduct sections 1.150.040 and 1.700.040. We remain responsible for our providers.
- All transfers are encrypted in transit, and participant-level data is limited to what the audit requires. Participant-level data is processed by Microsoft Azure services under Microsoft’s data terms, and Social Security number formatted values are masked before storage.
- Web research for client acceptance and planning uses only public information, such as the plan sponsor’s name and its Form 5500 filings. Client documents are never provided to the search step.
- Both language models run on Microsoft Azure resources. No client data is sent to OpenAI, L.L.C. or xAI Corp.
- We review this list before each engagement season and update the date at the top when it changes.
Contact
Questions about this list, or a request for the underlying terms: hello@ledgerlineaudit.com.