Taxpace and Pacekeeping Data Processing Agreement

Version: 2026-10-12 · Status: draft for attorney review

This Data Processing Agreement (the "DPA") is part of the Taxpace and Pacekeeping Terms of Service between Twenty Techworks LLC (the "Service Provider") and the Subscriber that uses the Service with its clients' data: a tax firm, an accounting practice or a preparer (the "Firm"). Capitalized terms not defined here have the meaning given in the Terms.

It is written so the Firm, when it is a financial institution, can meet its obligation, under the FTC Safeguards Rule (16 CFR §314.4(f)), to oversee service providers through a contract that requires them to maintain appropriate safeguards. It also helps the Firm meet IRS Publication 4557 and IRC §7216.

1. Roles and scope

• Roles: the Firm is responsible for its customers' information (as a financial institution, where the Safeguards Rule applies). The Service Provider processes Client Data only as a service provider to the Firm.
• Products: this DPA applies to Taxpace, the Bundle and Pacekeeping Business. With Pacekeeping Personal, the Subscriber keeps its own books and serves no clients; this DPA applies to it only to the extent the data it uploads includes other people's personal information. [ATTORNEY: confirm.]
• Scope: this DPA covers all Client Data, including Taxpayer Information, Bookkeeping Information (statements, receipts, checks and what is produced from them) and any "customer information" as defined in 16 CFR §314.2. [ATTORNEY: confirm whether an accounting practice that only uses Pacekeeping Business is a financial institution under the Safeguards Rule.]

2. Instructions

• What we process: the Service Provider processes Client Data only to provide, secure and support the Service. It follows the Firm's documented instructions, which are given through the Terms, the Service's settings and the Firm's written requests.
• Unlawful instructions: the Service Provider will tell the Firm if it believes an instruction breaks the law.
• Artificial intelligence: reading with artificial intelligence the documents uploaded for that purpose is part of the Service, especially in Pacekeeping. The Service Provider does it only with the listed subprocessors, only to produce the result, and without the data being used to train models.
• Section 7216: the Service Provider will not use or disclose Taxpayer Information except as allowed for an auxiliary service provider under Treas. Reg. §301.7216-2(d).

3. Confidentiality of personnel

Everyone at the Service Provider who can access Client Data:

• is bound by confidentiality obligations;
• receives security training;
• has only the access their role needs.

How access to Client Data works:

• No routine access: day-to-day operation does not require looking at Client Data.
• When it happens: access happens only for support the Firm requests, for security, or because the law requires it.
• Records: every such access is logged.

4. Information security program

The Service Provider maintains a written information security program that matches the elements of 16 CFR §314.4. It includes at least the measures in Annex A. The Service Provider:

• names a qualified person to oversee the program;
• assesses risks at least annually;
• keeps the program up to date.

5. Subprocessors

• Authorization: the Firm authorizes the subprocessors listed at /legal/subprocesadores.
• Their obligations: the Service Provider binds each one to data-protection obligations at least as protective as this DPA, and remains responsible for their performance.
• New subprocessors: the Service Provider will give at least 30 days' notice before adding or replacing a subprocessor that will process Taxpayer Information.
• Objections: the Firm may object on reasonable grounds. If the parties cannot resolve the objection, the Firm may cancel and receive a refund of prepaid fees for the unused period.

6. Security incidents

• Notice: the Service Provider will notify the Firm without undue delay, and in any case within 72 hours after confirming a security incident that leads to unauthorized access to, or acquisition of, the Firm's Client Data.
• Content of the notice: what happened, what data was involved, what the Service Provider is doing, and a contact person.
• Help with the Firm's duties: the Service Provider will give reasonable help so the Firm can meet its own duties. These include:
  • notifying the FTC within 30 days when an event involves 500 or more consumers (16 CFR §314.4(j));
  • notifying the IRS Stakeholder Liaison;
  • meeting state breach-notification laws.

7. Assistance

The Service Provider will give reasonable help so the Firm can:

• answer requests from taxpayers about their information;
• complete security questionnaires;
• keep its own written information security program (WISP).

8. Data location

Client Data is stored and processed in the United States.

9. Return and deletion

• Export: during the subscription, the Firm can export its Client Data at any time.
• After the subscription is cancelled: nothing is deleted; Client Data stays in the account.
• After the account is closed or the agreement ends: the Service Provider makes Client Data available to view and export for 30 days. It then deletes Client Data automatically as described in Section 10 of the Terms (in no case later than 60 days), unless the law requires keeping it.
• Certificate: when the deletion is complete, the Service Provider sends an email as confirmation, and on request confirms it in writing.

10. Audits and information

• Every year: the Service Provider gives the Firm, on request, a summary of its security program and the results of its most recent risk assessment.
• Other reviews: for any further review, the parties agree in good faith on the scope and timing, once a year at most. The Firm pays any third-party costs.

11. Term

This DPA lasts as long as the Service Provider processes Client Data for the Firm.

12. Precedence

If this DPA and the Terms conflict on the protection of Client Data, this DPA governs.

Annex A. Security measures