Connector privacy notice

Nothing here is a claim of regulatory compliance. It describes what the product does with data, written so that a reviewer can check it against the software rather than take our word for it.

Three pieces, and whose they are

The connector runs on your own server, inside your network, beside your Sage 100 installation. We do not operate it and cannot reach it. The relay is a service we run on our own AWS account; your connector makes an outbound connection to it and it never connects inward to you. Your AI assistant is one you connect yourself, using your own account with that provider.

Data moves one way, on request: Sage, to your connector, to the relay, to your assistant. The connector is read-only against Sage for every feature this notice covers.

What passes through us

Whatever your questions ask for, from your Sage company. In practice that means customer records including names, postal addresses, email addresses and telephone numbers; sales orders and invoices; item, inventory and pricing data; and accounts-receivable balances. We do not choose what is read. Your question does, within the fixed set of read endpoints the product supports.

What we store, and for how long

This is the part most worth checking, so it is specific.

• Your Sage business records, in our database: none.No table holds them.
• In memory: answers are cached briefly so we do not re-query your server for the same question. The lifetime is set per endpoint and none is longer than a day. Nothing is written to disk, and a restart clears it.
• Audit trail: timestamp, request identifier, tenant, which principal, which tool, which endpoint, the decision, and parameter names with hashed values. The values themselves are not stored, so a customer number is recorded as a hash. Retained 400 days by default.
• Account data: your company and contact details, subscription state, and the credentials for your connector and your assistant connection.
• Usage counters: per-day request counts, for billing and capacity.

Backups of the account database are encrypted at rest in AWS S3 and are not publicly reachable.

Who else touches it

Our sub-processors, all in the United States: Amazon Web Services for hosting and backups, Cloudflarefor TLS, content delivery and the firewall in front of the relay,Stripe for subscription payments, andMigadu for the email we send you. Card details go to Stripe and never to us.

We give 30 days written notice before adding or changing a sub-processor, and you may terminate if you object.

Your AI provider is not our sub-processor

This distinction is deliberate and we would rather be plain about it. You connect your own assistant account to the relay. Data that reaches it does so under your agreement with that provider, and their retention and model-training posture is set by your plan with them, not by us. We cannot change it and will not represent it. If that posture matters to your business, it is a real question and it is theirs to answer.

Answers generated by AI

Answers are generated from your data by a third-party model. They can be wrong or incomplete. They are informational and are not advice. Verify anything you act on. We are not liable for decisions made in reliance on them. The same statement appears on the consent screen and your account page, so you should not be able to miss it.

Your choices

Stop the flow immediately by stopping the connector service on your own server; it is yours, and nothing of ours has to cooperate. Revoke your assistant's access from your account page, which ends the token family. Ask us for a copy or deletion of your account data. On cancellation we delete account data within 30 days, except where tax or accounting records must be kept, and audit entries age out on the schedule above.

What we do not do

We do not sell your data. We do not use it for advertising. We do not use your Sage data to train any model of ours, and we have no model of our own to train.

Gaps, stated rather than hidden

A data processing addendum is available to sign on request but is not published here. We are not SOC 2 certified and do not claim to be. We do not claim GDPR applicability; if you need a GDPR posture, ask before you buy. See also our security overview.

Contact

privacy@keywaysystems.com