This Data Ownership & Security Policy (the “Policy”) describes how Charbonneau Technologies (the “Company,” “we,” “us,” or “our”) treats ownership of, and protects, the data our clients entrust to us within the Services. It is incorporated into the Master Services Agreement and supplements the Privacy Policy.
1. Purpose & Scope
This Policy applies to Client Data processed within the Services, including the BusinessSystem application and the CT Monitoring service. It describes our commitments regarding data ownership and the administrative, technical, and physical safeguards we use to protect Client Data. It does not modify any more specific data or security terms agreed in a signed Order.
2. Data Ownership
Client Data belongs to the Client. As between the Parties, the Client retains all right, title, and interest in and to Client Data. We claim no ownership of Client Data and process it only to provide and support the Services, as directed by the Client, and as permitted by the applicable agreement and law. Company will process Client Data only to perform the Services and as documented by Client’s written instructions in the Agreement, Orders, and Data Protection terms. Company will not otherwise sell, rent, or otherwise commercialize Client Data. We do not use Client Data to advertise to the Client’s customers, and we do not sell Client Data. We may generate aggregated, de-identified operational metrics (for example, system health and performance statistics) that do not identify the Client or any individual, to operate and improve the Services.
3. Data Classification
We handle information according to its sensitivity. Client Data typically includes business-operational records such as quotes, jobs, purchase orders, inventory, and related documents, and may include contact information for the Client’s personnel, customers, and vendors. We treat all Client Data as confidential under the Master Services Agreement and apply controls appropriate to its sensitivity. The Services are not designed for sensitive personal information, and the Client will not upload or store Social Security numbers, taxpayer identification numbers, bank account or payment card numbers, or health information in the Services. The Client is responsible for any consents required for the data it places into the Services.
4. Tenant Isolation & Architecture
The Services use a dedicated, single-tenant architecture. Each Client is provisioned with its own Deployment — a separate application instance and its own database — rather than sharing a common multi-tenant database with other clients. This means:
- Client Data is isolated at the application and database level by design, not solely by access rules within a shared store;
- One Client’s Deployment does not have access to another Client’s Deployment or data; and
- Configuration, updates, and data handling can be managed per Client.
The CT Monitoring service receives operational signals (such as heartbeats, error events, integration status, and daily metrics) from each Deployment to support availability and reliability, and is operated so that monitoring information is handled consistent with this Policy.
Application and platform logs from each Deployment are collected in a Company-controlled logging workspace hosted in Microsoft Azure, which is accessible only to authorized Company personnel and used only to operate, secure, and support the Services.
5. Access Controls
We restrict access to Client Data to authorized personnel who need it to deliver and support the Services, following the principle of least privilege. Controls include:
- Authenticated user access to the Services, with role-based permissions within the application;
- Administrative access to systems limited to authorized Company personnel;
- Multi-factor authentication on administrative and hosting (Azure) accounts; and
- Prompt review and removal of access when it is no longer required.
The Client is responsible for managing its own users’ access within the Services and for safeguarding user credentials. The Client may request a role-based access visibility report from the Company, which may include access logs related to Client Data, provided at reasonable intervals from the logs the Services maintain. The Client will promptly disable access for personnel or users who no longer require it and will review access at least quarterly.
6. Encryption
We use encryption to protect Client Data:
- In transit. Access to the Services is protected using industry-standard transport encryption (TLS/HTTPS).
- At rest. Client Data is encrypted at rest using Azure’s platform-managed, infrastructure-level storage encryption (256-bit AES).
7. Backups & Recovery
We perform regular backups of Client Deployments to support recovery in the event of data loss or system failure. Unless otherwise stated in an Order:
- Backups are performed on at least a daily basis;
- Backups are retained for 30 days;
- Our target recovery point objective (RPO) is 24 hours and target recovery time objective (RTO) is 24 hours; and
- We periodically verify that backups can be restored.
These objectives are targets based on our standard practices and may be tailored for a specific Client in an Order.
8. Infrastructure & Hosting
The Services are hosted on Microsoft Azure infrastructure in the Central US region. Our hosting providers maintain physical and environmental security controls for their data centers. Each Deployment runs as a dedicated container application with its own managed PostgreSQL database and document storage. We maintain the application and its container images, apply application updates and security patches on a reasonable schedule, and monitor Deployments through the CT Monitoring service. Microsoft manages and patches the underlying container platform, operating system, and managed database service. Backups are replicated to a secondary U.S. Azure region.
9. Incident Response
We maintain processes to detect, investigate, and respond to security incidents affecting Client Data. “Security Incident” means unauthorized access to or acquisition of Client Data. Service outages and availability are governed by the Service Level Agreement, not this Section. If we become aware of a Security Incident that has compromised, or is reasonably likely to have compromised, a Client’s Client Data, we will:
- The Company will notify the affected Client without undue delay, and in any event within 72 hours after confirming a Security Incident.
- The Company will promptly investigate, mitigate, contain, and remediate the Security Incident; preserve relevant evidence; and provide the Client with regular updates at least once each business day until the Security Incident is contained and remediated.
- The Company will provide root cause analysis and corrective action plan within 5 business days of containment. The Company will not make any public statements, notifications, or filings regarding a Security Incident without Client’s prior written approval, except as required by law and after providing advance notice to Client to the extent legally permitted.
- To the extent a Security Incident is caused by Company’s breach of this Policy or the Master Services Agreement, the Company will bear its own costs of investigating and remediating the Security Incident, provide any notifications required of the Company by applicable law, and cooperate reasonably with the Client, in each case subject to the limitation of liability in the Master Services Agreement. The Company is not responsible for Security Incidents caused by the compromise of Client credentials, the acts or omissions of Client users, or Client-controlled third-party accounts (including QuickBooks Online and Microsoft Office 365).
10. Data Portability & Return
During an active engagement, the Client may request an export of its Client Data in a commonly used format. On termination or expiration of the applicable Order, we will, on the Client’s request made within thirty (30) days, make Client Data available for export, after which we will permanently delete or de-identify Client Data in our production systems within 60 days, except for copies retained in routine backups (which are deleted on the backup cycle) or as required by law. We will confirm deletion on the Client’s reasonable request.
11. Sub-processors
We may engage third-party service providers (“sub-processors”) to help deliver the Services, such as cloud hosting and infrastructure providers. We enter into agreements with sub-processors that require appropriate confidentiality and security protections and use of the data only to provide services to us. Integrations that the Client chooses to enable — such as QuickBooks Online and Microsoft Office 365 / Microsoft Graph — involve the Client’s own third-party accounts and are governed by those providers’ terms. Our current sub-processors are Microsoft (Azure cloud hosting, databases, document storage, and logging) and, where AI-assisted features are enabled, Anthropic (AI-assisted extraction of data from purchasing and vendor documents). We will give the Client notice before engaging a new sub-processor that will process Client Data.
The Company is responsible for the acts and omissions of its sub-processors to the same extent as for its own performance. The Company will require its sub-processors, in written agreements, to maintain confidentiality and security obligations substantially similar to those in this Policy, where commercially available. Infrastructure providers operating under their standard terms (such as Microsoft Azure) and integrations the Client chooses to enable are governed by those providers’ terms.
12. Contact
Questions about this Policy, or requests relating to data security and ownership, can be directed to Charbonneau Technologies at dougc@charb-tech.com or 678-386-7659.
Questions about this document? Email dougc@charb-tech.com or call 678-386-7659.