BilagPilot UK Data Processing Agreement

Version: 1.1 Last updated: 15 August 2026

Canonical URL: https://bilagpilot.com/dpa

Related documents:

• Terms of Service
• Privacy Policy
• Data Retention Schedule

Plain-English overview

• The Customer decides why its client and workflow data is processed and remains responsible for having a lawful basis.
• Bjorvand Solutions processes that data only to provide BilagPilot on the Customer's documented instructions.
• This DPA is incorporated into the Terms of Service. A separate DPA checkbox or handwritten signature is not required where the Customer validly accepts the Terms.
• Trial expiry, client deletion, request deletion and submission of an account-deletion request do not themselves perform immediate full deletion of Customer Personal Data.
• Return and deletion are completed through verified technical and operational processes. Any stated 30-day or 90-day periods are operational targets unless expressly described as fixed.
• Bjorvand Solutions assists with rights requests, security obligations, incidents, impact assessments and reasonable audits as required by law.
• The detailed retention criteria and targets are in the BilagPilot Data Retention Schedule.
• This overview is explanatory. The numbered terms and schedules below govern if there is any inconsistency.

1. Parties and status of this Agreement

This Data Processing Agreement, the DPA, is entered into between:

1. the business identified as the customer in the BilagPilot account, order form, subscription or other service agreement, the Customer or Controller; and
2. Bjorvand Solutions, organisation number 836 135 652, c/o Rengjøringshjelpen Kragerø AS, Kirkegata 12, 3770 Kragerø, Norway, the Processor.

The DPA forms part of the agreement governing the Customer's use of BilagPilot, including the BilagPilot Terms of Service, any applicable order form and any written amendments, together the Service Agreement.

The DPA becomes binding when the Customer accepts the Terms of Service, an order form or another electronic acceptance flow that incorporates this DPA, or otherwise signs or expressly accepts it. A separate DPA checkbox or handwritten signature is not required where electronic acceptance is legally valid.

The BilagPilot Privacy Policy is a transparency notice and does not replace this DPA. The BilagPilot Data Retention Schedule forms part of this DPA for Customer Personal Data.

If the Customer is itself a processor acting for another controller, the Customer appoints Bjorvand Solutions as its subprocessor. References to the Controller include the relevant ultimate controller only to the extent required by applicable law, and the Customer remains responsible for having authority to appoint Bjorvand Solutions.

2. Definitions

In this DPA:

Applicable Data Protection Law means, to the extent applicable to the processing:

• the UK General Data Protection Regulation, the UK GDPR;
• the Data Protection Act 2018;
• the Privacy and Electronic Communications Regulations 2003, where relevant;
• the EU General Data Protection Regulation, Regulation (EU) 2016/679, the EU GDPR;
• the Norwegian Personal Data Act and related Norwegian data protection rules; and
• any binding amendment, replacement or implementing law.

Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Processing, Special Category Data and Supervisory Authority have the meanings given by Applicable Data Protection Law.

Customer Personal Data means Personal Data processed by Bjorvand Solutions on behalf of the Customer through BilagPilot. It does not include Personal Data for which Bjorvand Solutions independently determines the purposes and means, such as its own billing, account administration, fraud prevention, security, legal compliance and ordinary support-administration records. Where support requires Bjorvand Solutions to access or otherwise process Customer Personal Data solely to assist the Customer, that processing remains subject to this DPA.

Customer-directed Service means a third-party accounting system, identity provider or other service that the Customer independently selects, contracts with or instructs BilagPilot to connect to.

Subprocessor means another processor engaged by Bjorvand Solutions to process Customer Personal Data on behalf of the Customer. A Customer-directed Service is not a Subprocessor solely because BilagPilot transmits data to it on the Customer's documented instruction.

BilagPilot means the B2B document-request, reminder, upload, review, status and integration service supplied by Bjorvand Solutions.

User means an individual authorised by the Customer to use BilagPilot on its behalf.

Client means a client, client contact, supplier, employee or other recipient from whom the Customer requests documents, responses or information through BilagPilot.

Restricted Transfer means a transfer of Personal Data that requires an adequacy regulation, appropriate safeguard, exception or other transfer mechanism under Applicable Data Protection Law.

3. Scope, roles and compliance

3.1 The Customer is the Controller of Customer Personal Data. The Customer determines the purposes of the processing and gives the instructions described in this DPA.

3.2 Bjorvand Solutions is the Processor of Customer Personal Data when it processes that data to provide BilagPilot on the Customer's behalf.

3.3 Bjorvand Solutions acts as an independent controller for Personal Data it processes for its own purposes, including account creation, authentication administration, subscription and payment administration, security, fraud and abuse prevention, service analytics, legal compliance, contract evidence, ordinary support administration and operation of its business. That processing is governed by the BilagPilot Privacy Policy and is outside the processor instructions in this DPA. Where a support activity involves processing Customer Personal Data solely on the Customer's behalf, sections 3.2 and 5 apply to that processing.

3.4 Each party must comply with the obligations that apply to it under Applicable Data Protection Law. Nothing in this DPA relieves either party of its direct statutory duties or liabilities.

3.5 The Customer warrants that:

• it has a lawful basis for the processing and for each instruction it gives;
• it has provided all required privacy information to Data Subjects;
• it has authority to disclose Customer Personal Data to Bjorvand Solutions and its authorised Subprocessors;
• its instructions do not infringe Applicable Data Protection Law or third-party rights;
• it will use appropriate data minimisation and retention rules; and
• it will not use BilagPilot as its only legally required accounting archive.

4. Processing details

The subject matter, duration, nature, purpose, Personal Data types and Data Subject categories required by Article 28(3) UK GDPR are described in Schedule 1.

5. Documented instructions

5.1 Bjorvand Solutions will process Customer Personal Data only on the Customer's documented instructions, including instructions concerning a Restricted Transfer, unless processing is required by a law binding on Bjorvand Solutions.

5.2 The Customer's documented instructions consist of:

• the Service Agreement and this DPA;
• the Customer's configuration, settings and actions within BilagPilot;
• the features and integrations the Customer activates;
• the Customer's uploads, requests, messages, exports and deletion actions; and
• additional written instructions accepted by Bjorvand Solutions, including instructions sent by an authorised Customer contact by email.

5.3 Bjorvand Solutions may make reasonable day-to-day technical, security and operational decisions needed to carry out the instructions, provided those decisions do not change the Customer's purposes for processing.

5.4 If a binding law requires Bjorvand Solutions to process Customer Personal Data other than on the Customer's instructions, Bjorvand Solutions will inform the Customer before the processing unless the law prohibits that notice on important grounds of public interest.

5.5 Bjorvand Solutions will inform the Customer without undue delay if, in its reasonable opinion, an instruction infringes Applicable Data Protection Law. It may suspend the affected processing until the instruction is confirmed, amended or withdrawn. Bjorvand Solutions is not required to provide legal advice to the Customer.

5.6 Instructions outside the ordinary functionality and scope of BilagPilot may require a feasibility review, a separate written agreement and reasonable additional fees.

6. Confidentiality and authorised personnel

6.1 Bjorvand Solutions will ensure that each person authorised to process Customer Personal Data:

• processes it only as necessary to perform their duties;
• is subject to a binding duty of confidentiality or an appropriate statutory duty; and
• receives data protection and security instructions appropriate to their role.

6.2 Access to Customer Personal Data is restricted according to need, role and the principle of least privilege, taking into account the size and operating model of Bjorvand Solutions.

6.3 The confidentiality obligations continue after a person's access or engagement ends.

7. Security of processing

7.1 Bjorvand Solutions will implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

7.2 The measures will take account of the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the risk to Data Subjects.

7.3 The current core measures are described in Schedule 2. Bjorvand Solutions may update the measures where the change maintains or improves the overall level of protection and does not materially reduce security.

7.4 No system can be guaranteed to be completely secure. The Customer remains responsible for securing its own accounts, devices, email systems, telephone numbers, Users, passwords, identity-provider settings, integration permissions and public upload links.

7.5 Public upload links are bearer links and do not provide reliable identity verification. The Customer must limit the information exposed through requests and must share links only with intended recipients.

8. Subprocessors

8.1 The Customer gives Bjorvand Solutions general written authorisation to engage Subprocessors necessary to provide, secure, support and operate BilagPilot.

8.2 Bjorvand Solutions will make a current Subprocessor list reasonably available through the service, its website, Schedule 3 to this DPA or another durable written method. Schedule 3 is the current contractual baseline until a complete public international supplier and Subprocessor register is published. A partial English supplier page exists, but it must not be treated as exhaustive unless it is expressly identified as complete and current.

8.3 Before a new Subprocessor begins processing Customer Personal Data, Bjorvand Solutions will, where reasonably practicable, give at least 15 days' prior notice by email, in-product notice, an updated Subprocessor list or another durable method. Immediate changes may be made where necessary to address a security incident, service outage, legal requirement or urgent provider failure. In that case, notice will be given as soon as reasonably practicable.

8.4 The Customer may object during the notice period on reasonable and documented data-protection grounds specific to the new Subprocessor. The parties will work in good faith to resolve the objection. If no reasonable solution is available, Bjorvand Solutions may allow the Customer to stop using the affected feature or terminate the affected service. Commercial consequences are governed by the Service Agreement.

8.5 Bjorvand Solutions will enter into a written agreement with each Subprocessor that imposes data-protection obligations offering an equivalent level of protection for the relevant processing as required by Article 28(3) UK GDPR.

8.6 Bjorvand Solutions remains responsible to the Customer for a Subprocessor's performance of its data-protection obligations to the extent required by Applicable Data Protection Law.

8.7 Customer-directed Services are used on the Customer's instruction and may have separate contracts, privacy terms, retention periods and security responsibilities between the Customer and that provider. Bjorvand Solutions remains responsible for securely implementing the BilagPilot side of the connection and following the Customer's documented instruction.

8.8 Where the Customer acts as a processor for another controller, the Customer is responsible for passing on relevant Subprocessor notices, obtaining any authorisation required from that controller and ensuring that its instructions to Bjorvand Solutions are authorised.

9. International transfers

9.1 Bjorvand Solutions is established in Norway. Transfers of Personal Data from the United Kingdom to Norway are currently covered by United Kingdom adequacy regulations applicable to the European Economic Area.

9.2 Customer Personal Data may also be processed in other countries by authorised Subprocessors or Customer-directed Services, depending on the features the Customer uses.

9.3 Bjorvand Solutions will not make a Restricted Transfer unless it is covered by a lawful transfer mechanism, which may include:

• United Kingdom adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to the European Commission Standard Contractual Clauses;
• the European Commission Standard Contractual Clauses where the EU GDPR applies;
• an approved certification, code, binding corporate rules or another appropriate safeguard; or
• a lawful exception where its requirements are met.

9.4 Where required, Bjorvand Solutions will carry out or support a transfer risk assessment, also referred to in current UK law and guidance as a data protection test, and will implement supplementary measures where reasonably necessary.

9.5 If a transfer mechanism used for the service becomes invalid or materially restricted, the parties will cooperate in good faith to implement a valid replacement. Bjorvand Solutions may suspend the affected transfer or feature where no lawful alternative is reasonably available.

10. Data Subject requests

10.1 Taking into account the nature of the processing, Bjorvand Solutions will provide appropriate technical and organisational assistance reasonably available through BilagPilot to help the Customer respond to requests by Data Subjects exercising their rights.

10.2 If Bjorvand Solutions receives a request concerning Customer Personal Data directly from a Data Subject, it will:

• notify the Customer without undue delay where the Customer can reasonably be identified;
• not respond substantively except on the Customer's documented instruction or where legally required; and
• direct the Data Subject to the Customer where appropriate.

10.3 The Customer is responsible for deciding whether and how to respond, verifying identity, identifying applicable rights and meeting statutory deadlines.

10.4 Assistance requiring custom development, extensive searches, restoration of deleted material or work outside ordinary support may be charged at a reasonable rate, unless the assistance is required because Bjorvand Solutions breached this DPA or Applicable Data Protection Law.

11. Assistance with compliance

Taking into account the nature of the processing and the information available to it, Bjorvand Solutions will provide reasonable assistance to the Customer with:

• security obligations under Article 32 UK GDPR;
• assessment and notification of Personal Data Breaches under Articles 33 and 34 UK GDPR;
• data protection impact assessments under Article 35 UK GDPR;
• prior consultation with the Information Commissioner's Office or another competent Supervisory Authority under Article 36 UK GDPR; and
• information reasonably needed to demonstrate the Customer's compliance in relation to BilagPilot.

The Customer remains responsible for its own compliance decisions, risk assessments, notices and regulatory communications.

12. Personal Data Breaches

12.1 Bjorvand Solutions will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.

12.2 The notice will include, to the extent known and reasonably available:

• the nature of the breach;
• the categories and approximate number of affected Data Subjects and records;
• the likely consequences;
• the measures taken or proposed to contain, investigate and mitigate the breach; and
• a contact point for further information.

12.3 Information may be provided in phases without undue further delay where it is not available at the time of the initial notice.

12.4 Bjorvand Solutions' notice of an incident is not an admission of fault or liability.

12.5 The Customer is responsible for deciding whether notification to the Information Commissioner's Office, another authority or affected Data Subjects is required. Bjorvand Solutions will provide reasonable cooperation.

13. Records, information and audits

13.1 Bjorvand Solutions will maintain records of its processing activities to the extent required by Applicable Data Protection Law.

13.2 Bjorvand Solutions will make available information reasonably necessary to demonstrate compliance with Article 28 UK GDPR and this DPA. It may satisfy this obligation through relevant policies, security summaries, questionnaires, independent reports, certifications, audit summaries or other suitable evidence.

13.3 The Customer may conduct an audit itself or through an independent qualified auditor bound by confidentiality, subject to the following reasonable conditions:

• documentary and remote evidence will be used first where it can reasonably satisfy the audit purpose;
• the Customer must give at least 30 days' written notice, unless a Personal Data Breach, regulator or credible evidence of material non-compliance requires shorter notice;
• ordinary audits are limited to once in any 12-month period;
• the audit must occur during normal business hours and minimise disruption;
• the audit must be limited to systems, records and processing relevant to the Customer;
• the audit must not expose another customer's data, source code, credentials, vulnerability details, trade secrets or information that would create a security risk; and
• the Customer bears its own costs and Bjorvand Solutions' reasonable costs, unless the audit identifies a material breach by Bjorvand Solutions.

13.4 Nothing in this section restricts a competent Supervisory Authority's lawful powers.

14. Return, deletion and retention

14.1 During the service period, the Customer may use the available standard export functions to obtain Customer Personal Data in the formats supported by BilagPilot.

14.2 At the end of the service, Bjorvand Solutions will, at the Customer's choice, return or delete Customer Personal Data and delete existing copies, unless a binding law requires limited continued storage. Return is provided through an available standard export where reasonably practicable. The Customer may give its instruction through the service or by a durable written method.

14.3 If the Customer gives no return instruction, the default is deletion under the BilagPilot Data Retention Schedule after the relevant export, closure and operational review steps. The Customer should submit any return request promptly and before ordinary access ends.

14.4 Current product behaviour is as follows:

• trial expiry changes the trial state, access rights, grants and inbound-upload permissions, but does not delete Customer Personal Data;
• deleting a request is primarily an archive operation, so public tokens may be revoked and reminders stopped while history and uploaded files remain;
• deleting a client marks the client inactive or soft-deleted and archives active requests, while related history and uploaded files may remain; and
• submitting account deletion creates a verified deletion request and an internal notification for manual review. It does not itself perform immediate full deletion.

14.5 Before acting on a deletion or return instruction, Bjorvand Solutions may verify the requesting person's identity, authority and workspace ownership, clarify the requested scope, resolve active subscription or billing status, identify legal-retention requirements, and determine the dependent records, storage objects, integrations, Subprocessors and backups affected.

14.6 Bjorvand Solutions will carry out a verified and actionable deletion or return instruction without undue delay. The 30-day and 90-day periods described in the Retention Schedule are operational targets and review points, not guarantees that every copy will be automatically removed on an exact day. A target may be exceeded where reasonably necessary because of the request's scope, technical dependencies, provider deletion or backup cycles, legal holds, security investigations, disputes, regulator or court requirements, or another lawful and documented reason.

14.7 A repository audit found no evidence of a general automatic job that deletes or anonymises all Customer Personal Data within a fixed 90-day period. Deletion may therefore be staged and completed through manual and operational processes. This does not permit Bjorvand Solutions to retain Customer Personal Data indefinitely or to continue ordinary use after it is no longer needed.

14.8 Data deleted from active systems may remain in protected backups or Subprocessor systems until the relevant deletion or backup rotation process completes. During that period, Bjorvand Solutions will put the data beyond ordinary use where reasonably practicable and will process it only for restoration, security, legal compliance or another justified purpose.

14.9 Bjorvand Solutions will pass applicable deletion or return instructions to relevant Subprocessors and take reasonable steps to obtain completion under its contracts. Exact provider backup periods, processing locations and transfer arrangements are subject to the applicable provider contracts and verification described in the Retention Schedule and Subprocessor documentation.

14.10 Where law requires Bjorvand Solutions to retain a limited copy, it will isolate or restrict the retained data where reasonably practicable, use it only for the required purpose and delete it when the requirement ends, unless prohibited from informing the Customer.

14.11 Custom exports, migration assistance, complex deletion scoping or restoration from backups may be subject to technical feasibility, a separate scope and reasonable fees, unless the work is required because Bjorvand Solutions breached this DPA or Applicable Data Protection Law.

15. Use restrictions and service improvement

15.1 Bjorvand Solutions will not sell Customer Personal Data or use it for third-party targeted advertising.

15.2 Bjorvand Solutions will not knowingly opt Customer Personal Data into general-purpose third-party model training without the Customer's separate written agreement and an appropriate lawful basis.

15.3 Bjorvand Solutions may create and use statistics or data that has been irreversibly anonymised so that it is no longer Personal Data, including for security, capacity planning, analytics and service improvement.

15.4 Smart Kontroll provides workflow assistance only. It does not make solely automated decisions about individuals that produce legal or similarly significant effects on behalf of Bjorvand Solutions. The Customer remains responsible for human review and all professional accounting decisions.

16. Liability

16.1 Each party remains responsible for its own acts, omissions and direct obligations under Applicable Data Protection Law.

16.2 Liability arising under or in connection with this DPA is subject to the exclusions and limitations in the Service Agreement to the maximum extent permitted by law.

16.3 Nothing in this DPA limits liability that cannot lawfully be limited, prevents a Data Subject from exercising statutory rights, or restricts a Supervisory Authority's lawful powers.

17. Term and termination

17.1 This DPA applies for as long as Bjorvand Solutions processes Customer Personal Data on behalf of the Customer.

17.2 Sections that by their nature must survive termination, including confidentiality, audits concerning the service period, return and deletion, liability and legal holds, continue for as long as necessary.

18. Order of precedence

18.1 If there is a conflict concerning the protection or processing of Customer Personal Data:

1. a mandatory UK IDTA or UK Addendum term applies first for the relevant Restricted Transfer;
2. this DPA applies next;
3. the Service Agreement applies after that; and
4. other written instructions apply last, unless the parties expressly agree otherwise.

18.2 The BilagPilot Data Retention Schedule forms part of this DPA. If it conflicts with section 14, the provision that gives greater effect to the Controller's lawful deletion or return instruction and mandatory Applicable Data Protection Law applies.

19. Governing law and disputes

19.1 This DPA follows the governing law and dispute provisions in the Service Agreement, subject to mandatory rights and obligations under Applicable Data Protection Law.

19.2 Nothing prevents either party from cooperating with or making a legally protected report to a competent Supervisory Authority.

20. Notices and contact

Data protection notices and instructions under this DPA must be sent by a durable written method, including email, to the contact details recorded in the Customer's BilagPilot account and to:

Bjorvand Solutions Organisation number: 836 135 652 c/o Rengjøringshjelpen Kragerø AS Kirkegata 12 3770 Kragerø Norway Email: kevin@bilagpilot.no

Schedule 1: Processing details

1. Subject matter

Provision of BilagPilot, a B2B workflow service that helps accounting firms identify possible missing accounting documentation, create requests, send reminders, receive files and responses, review material, track status and send approved files to supported accounting systems.

2. Duration

For the service period and the limited return, deletion, backup and legal-retention periods described in section 14 and the BilagPilot UK Data Retention Schedule.

3. Nature of processing

The processing may include collection, receipt, recording, organisation, structuring, storage, hosting, retrieval, consultation, display, matching, classification, transmission, synchronisation, export, restriction, archiving, deletion and other operations necessary to provide the Customer's selected BilagPilot features.

4. Purpose of processing

The purpose is to provide BilagPilot on the Customer's instructions, including:

• account and User access to Customer workspaces;
• importing and managing client records;
• identifying or importing possible missing documents;
• creating periods, requests, request items and deadlines;
• generating and operating secure upload links;
• sending email and SMS messages and reminders;
• receiving files, text responses, status selections and inbound email;
• supporting receipt declarations;
• providing Smart Kontroll where enabled;
• reviewing, sorting, approving, rejecting and tracking material;
• operating integrations activated by the Customer;
• forwarding approved files where supported;
• providing exports, history, activity and audit records;
• securing, supporting, maintaining and troubleshooting the service; and
• deleting or returning Customer Personal Data.

5. Types of Personal Data

Customer Personal Data may include:

• names, business email addresses, telephone numbers, roles and relationships;
• business names, company identifiers and contact persons;
• client records, Customer IDs, provider IDs and accounting-system mappings;
• periods, deadlines, request text, request items, notes, comments, statuses and responses;
• accounting documents, receipts, invoices, payment evidence and other uploaded files;
• filenames, file types, sizes, MIME types, storage paths and upload metadata;
• receipt declaration details, signatures, generated PDFs, attachments and risk flags;
• email and SMS content, inbound email, delivery metadata and upload links;
• public-link token metadata, link history and access events;
• integration tokens, API keys, OAuth state, organisation IDs, synchronisation runs, raw provider metadata, upload attempts and error records;
• Smart Kontroll inputs, outputs, model details, explanations, confidence information, evidence and status;
• User roles, workspace membership, sessions, access events and security metadata; and
• technical, audit and activity logs relating to the Customer's use of BilagPilot.

The service is not designed for routine processing of Special Category Data or criminal-offence data. Such data may nevertheless appear incidentally in documents or messages uploaded by the Customer or its Clients. The Customer must minimise this data and ensure that any such processing is lawful and necessary.

6. Categories of Data Subjects

Customer Personal Data may relate to:

• the Customer's owners, partners, Users and employees;
• the Customer's clients and client contacts;
• directors, employees, suppliers, contractors and representatives of the Customer's clients;
• persons who receive or use an upload link;
• persons who send email to an inbound address;
• persons named or otherwise identifiable in accounting documents, messages, receipt declarations or attachments; and
• other individuals whose data the Customer lawfully directs BilagPilot to process.

7. Frequency and scale

Processing occurs continuously or as initiated by the Customer, its Users, Clients, integrations and scheduled reminder or synchronisation functions. Scale depends on the Customer's plan, number of Users and clients, request volume, file volume and enabled features.

8. Controller rights and obligations

The Customer retains control over the purposes of processing and may, subject to the Service Agreement and technical capabilities:

• add, view, correct, export, archive or delete data;
• configure Users, roles, assignments, links, reminders and integrations;
• disconnect integrations;
• instruct return or deletion; and
• request information, assistance and audits under this DPA.

Schedule 2: Technical and organisational measures

Bjorvand Solutions maintains measures designed for the risk and scope of BilagPilot. Current core measures include:

1. Authentication and access control

• Authentication through Supabase Auth.
• Supported sign-in methods may include email and password, email verification, password reset, invitations, Google OAuth, Microsoft OAuth and SAML SSO.
• Workspace access based on membership and role.
• Owner and accountant roles, with client assignment controls where supported.
• Server-side checks for workspace, role, membership, client assignment and entitlement before protected operations.
• Restricted internal access based on operational need.

2. Tenant and database protection

• Separation of operational data by workspace or bureau identifier.
• Supabase Row Level Security for core tenant tables where implemented.
• Server-side validation before sensitive reads, writes, exports and downloads.
• Production database and private file storage configured in an EU region.

3. File and storage protection

• Private file storage rather than public buckets for Customer uploads.
• Short-lived signed URLs or authenticated same-origin streaming for authorised preview and download.
• Upload paths scoped to the relevant workspace, client or request.
• Prepare and finalise controls for uploads, including reservation, storage-path and database-commit checks.
• Validation of file count, size, type, extension, MIME type and technical file signature where supported.
• Technical file validation is provided, but BilagPilot does not replace the Customer's endpoint security, malware scanning or professional document controls.

4. Public upload-link protection

• Bearer tokens generated for public upload links.
• Hashed token storage where implemented.
• Link expiry, revocation and rotation controls.
• Validation of workspace, client, request, status and expiry before accepting data.
• Public links do not constitute verified identity and must be protected by the Customer.

5. Credentials and integrations

• Integration tokens, API keys and client keys encrypted on the server where relevant.
• Secrets are not intentionally exposed to the browser in readable form.
• Provider-specific OAuth, access and permission checks.
• Logging of synchronisation runs, upload attempts, failures and relevant audit events.
• Duplicate-sensitive operations use claims, reservations or idempotency controls where implemented.

6. Communications and webhooks

• Signature validation for supported Stripe, email and other provider webhooks where implemented.
• Delivery status and error handling for email and SMS.
• Raw upload links may appear in message history and provider systems, so access to communication records is restricted and links expire or may be revoked.

7. Logging, monitoring and analytics

• Logging of relevant access, security, activity, provider and operational events.
• Error tracing and bot or rate protection where configured.
• Product analytics configured to discard events for public upload routes under /u and /upload.
• Retention and deletion under the BilagPilot Data Retention Schedule, including its distinction between confirmed technical expiry, retention criteria and operational targets.

8. Development and change controls

• Server-side authorisation for owner-only and other sensitive actions.
• Validation and testing of security-sensitive functionality proportionate to the change.
• Separation of production and staging environments.
• Controlled deployment of database migrations and application changes.

9. Incident response, availability and recovery

• Procedures to identify, assess, contain, investigate and communicate security incidents.
• Use of infrastructure-provider resilience, backup and restoration capabilities appropriate to the service.
• Review and improvement of measures following material incidents or identified weaknesses.

Schedule 3: Initial Subprocessor and service categories

The following providers may process limited Customer Personal Data depending on the Customer's configuration and enabled features. This Schedule is the current contractual baseline, but it may be supplemented by an updated list or direct notice. A partial English supplier page exists, but a complete public international supplier and Subprocessor register is not yet available. Provider contract entities, exact processing locations, backup periods and transfer arrangements are made available as they are verified and must not be inferred solely from that partial page.

Stripe processes billing and payment data for Bjorvand Solutions' controller purposes and does not receive Customer accounting-document content as part of ordinary payment processing.

Google and Microsoft may process authentication or OAuth data for Bjorvand Solutions' controller purposes or as Customer-directed Services, depending on the flow selected by the User or Customer.

Xero, QuickBooks Online and a Customer's chosen SAML or accounting provider are generally Customer-directed Services where the Customer has a separate account and directs BilagPilot to connect. Their treatment as a direct recipient, independent controller, processor or Subprocessor depends on the relevant data flow and contract. BilagPilot will identify any provider it engages as a Subprocessor in the maintained Subprocessor list.