ForgeSync Subscription Agreement
This ForgeSync Subscription Agreement (the “Agreement”) is between Keyway Systems LLC, a [state of formation] limited liability company (“Keyway”), and the merchant that installs the ForgeSync app on a Shopify store and subscribes to a Plan (the “Customer”). This Agreement takes effect on the date the Customer first accepts it [in the Shopify install flow or by signature] (the “Effective Date”).
By installing ForgeSync and approving a Subscription in Shopify, the Customer agrees to this Agreement, including the Support and Service Level Schedule (the “Support Schedule”) and the Data Processing Addendum (the “DPA”), both of which are part of this Agreement.
1. Definitions
1.1 “Software” means the ForgeSync application: the server-side code Keyway delivers for installation on the Customer Server, the Sage Connector, the ForgeSync Shopify app, the command-line tools, and all Updates. The Software includes third-party open-source components listed in the NOTICE file, which are licensed under their own terms.
1.2 “Sage Connector” means the ForgeSync connector service that the Customer installs as a Windows service on the Customer’s Sage 100 server and that carries traffic between the Customer Server and Sage 100. [Confirm this is the component the plan listing calls the “Sage AI Connector”.]
1.3 “Relay” means the small hosted service that Keyway operates, which (a) completes the Shopify app install for the Customer’s Store and delivers the resulting Shopify access credential to the Customer Server, (b) receives Shopify webhooks for the Store and forwards them to the Customer Server, (c) verifies Shopify staff session tokens and storefront app-proxy requests and forwards them to the Customer Server, (d) redirects the embedded admin entry point to the Customer Server, and (e) renews the Store’s short-lived Shopify access token when the Customer Server asks it to. The Relay holds the Shopify app secret on the Customer’s behalf and does not store the content of anything it forwards.
1.4 “Store” means the single Shopify store, identified by its myshopify.com domain, on which the Customer has installed the ForgeSync app and holds an active Subscription.
1.5 “Customer Server” means the server, in the Customer’s own Amazon Web Services (“AWS”) account, on which the Customer installs and runs the Software.
1.6 “Sage 100” means the Customer’s licensed copy of Sage 100 Premium accounting software and the server it runs on. Keyway does not supply, license, or host Sage 100.
1.7 “Plan” means one of the subscription plans in Section 2.2. “Core Plan” and “Pro Plan” have the meanings given there.
1.8 “Subscription” means the Customer’s right, for the paid term, to use the Software on the Store under the chosen Plan.
1.9 “Fees” means the recurring Plan charges billed through Shopify Billing, plus any separately agreed charges under Section 2.7.
1.10 “Shopify” means Shopify Inc. and its affiliates, and “Shopify Billing” means Shopify’s app subscription and charge approval system through which the Fees are billed.
1.11 “Marketplace” means eBay and Amazon, the third-party marketplaces the Pro Plan connects to, through the Customer’s own seller accounts.
1.12 “Customer Data” means all data the Customer or its Store, Sage 100, or Marketplace accounts supply to or generate in the Software: orders, refunds, customers, products, inventory, fulfilments, and the records created from them. Customer Data includes Personal Data as defined in the DPA.
1.13 “Sage Records” means the Customer’s books and records in Sage 100, including sales orders, invoices, and customer records that the Software creates or updates there.
1.14 “Documentation” means the customer-facing documentation Keyway supplies with the Software, including the prerequisites, install, backup and restore, and operator runbooks.
1.15 “Update” means any fix, patch, new release, or new version of the Software that Keyway makes available to subscribers. “Security Fix” means an Update that Keyway designates as correcting a security vulnerability.
1.16 “Confidential Information” has the meaning given in Section 9.
1.17 “Installation” means one running copy of the Software on one Customer Server connected to one Store and one Sage 100 company.
2. The Subscription
2.1 What the Subscription is. ForgeSync is a subscription. The Customer downloads the Software, installs it on the Customer Server, connects it to the Customer’s own Store and Sage 100, and Keyway supports it remotely as described in Section 5 and the Support Schedule. Keyway does not host the Software and does not hold the Customer’s production data.
2.2 Plans. Two Plans are offered:
(a) “ForgeSync Core”: synchronisation between the Store and Sage 100, including the Sage Connector. USD 1,500 per month.
(b) “ForgeSync Pro”: everything in Core, plus the eBay and Amazon Marketplace modules. USD 1,950 per month.
Both Plans are also offered on a yearly term at [yearly price; the pricing decision says “about two months free”, exact figure not set]. The Marketplace modules are available only while a Pro Plan is active.
2.3 Billing through Shopify. The Fees are billed and collected through Shopify Billing. The Customer approves the charge inside the ForgeSync app in the Shopify admin. Shopify’s billing terms, charge timing, currency handling, and refund mechanics apply to those charges. Keyway does not take card details and does not bill the Plan Fees outside Shopify.
2.4 Term and renewal. A monthly Subscription runs for one month from approval and renews automatically each month until cancelled. A yearly Subscription runs for twelve months from approval and [renews automatically for a further year unless cancelled before the renewal date / ends unless the Customer approves a new yearly charge]. Shopify’s approval flow may ask the Customer to approve a renewal or a changed charge; if the Customer does not approve, the Subscription ends when the current paid term ends.
2.5 No trial. There is no free trial. The Subscription is paid from the first term.
2.6 Price changes. Keyway may change the Fees for a Plan on at least [price-change notice period] written notice. A change takes effect at the start of the Customer’s next term after the notice period ends, never in the middle of a paid term. Shopify may require the Customer to approve the changed charge before it applies; if the Customer declines, the Subscription ends at the end of the current term.
2.7 Charges outside Shopify. Keyway may offer, at separate prices, a managed install service and Sage-side work that is not part of the Software. Those services are agreed and billed separately at the prices published on the Keyway website at the time of the order (as of 29 September 2026: Managed install $1,000, covering the AWS stack, the ForgeSync server, the Shopify connection, verification and cutover; Full install $2,500, adding the Sage 100 prerequisites on the Customer’s server; Sage AI Connector install $250, one remote session), each a one-time charge paid before the work is scheduled and are not part of the Plan Fees.
2.8 Taxes. The Fees do not include sales, use, value-added, or similar taxes. Where Shopify Billing collects tax on Keyway’s behalf, Shopify’s tax handling applies. Where it does not, the Customer is responsible for any such tax on the Fees, other than taxes on Keyway’s income.
2.9 One Store per Subscription. Each Subscription covers one Store. A second store needs its own Subscription.
3. Licence
3.1 Grant. For the term of the Subscription, Keyway grants the Customer a non-exclusive, non-transferable, non-sublicensable licence to install and use the Software on the Customer Server to connect the Store to the Customer’s own Sage 100 and, under a Pro Plan, the Customer’s own Marketplace seller accounts, for the Customer’s internal business.
3.2 One production Installation. The licence covers one production Installation per Subscription. The Customer may also run [number of non-production Installations] non-production Installations (for example a staging copy against a Shopify development store) for testing, provided they do not process live orders.
3.3 Source on the Customer Server. The Software is delivered as source code and compiled components onto the Customer Server. That delivery is not a sale and does not transfer ownership. The copy on the Customer Server, every backup of it, and every derived file remain subject to this Agreement and to the LICENSE file shipped with the Software.
3.4 What the Customer may not do. Except as this Agreement expressly allows, the Customer may not:
(a) copy the Software other than for backup and disaster recovery;
(b) sell, rent, lease, lend, sublicense, distribute, publish, or otherwise make the Software available to any third party, including as a hosted or managed service for others;
(c) create derivative works of the Software for any third party, or use the Software to build a competing product;
(d) decompile, disassemble, or reverse engineer the compiled components of the Software, including the Sage Connector, except to the extent applicable law forbids this restriction;
(e) remove or alter any copyright, trademark, or proprietary notice;
(f) use the Software to connect a store, Sage 100 company, or Marketplace account other than the ones covered by the Subscription;
(g) bypass, disable, or tamper with the Subscription entitlement check, the fleet beacon, or the Relay authentication.
3.5 Customer modifications. [Allan to decide, spec guard rail says “customisation is a module, never a fork”:] The Customer [may / may not] modify the source code of the Software for its own internal use. If modification is permitted: (a) modifications are made at the Customer’s risk; (b) Keyway has no obligation to support a modified Installation or an Update applied to one; (c) modified code remains Keyway’s Software under this licence; and (d) the supported way to add behaviour is a separate module rather than a change to the core code.
3.6 Open-source components. Third-party components listed in the NOTICE file are licensed under their own terms, which govern those components only. Nothing in this Agreement restricts the Customer’s rights under those licences.
3.7 Reservation. Keyway reserves all rights not expressly granted.
4. Customer responsibilities
4.1 AWS account. The Customer provides and pays for its own AWS account and the Customer Server, including compute, storage, networking, and the S3 bucket and secrets manager entry the Software’s backups use. The Customer is the account owner and controls all access to it.
4.2 Encrypted storage. The Customer must run the Customer Server on encrypted EBS volumes and must keep the S3 bucket that receives backup copies encrypted at rest. This is a stated requirement of the install, not a recommendation. The Software encrypts specific fields (Section 4.8 of the DPA) but relies on the volume for everything else, including the nightly database dump.
4.3 Sage 100. The Customer provides its own licensed Sage 100 Premium (version 2022 or later), the server it runs on, a dedicated Sage user and one spare concurrent licence seat for the Sage Connector, a read-only SQL login on the Sage company database, one elevated session to register the Sage Connector as a Windows service, the network rule that lets the Sage server reach the Customer Server, and the Sales Order user-defined field described in the Documentation. Each of these is verified by the install and a missing item stops the install.
4.4 Reachability. The Customer keeps the Customer Server running and reachable over HTTPS at the hostname registered with the Relay, keeps its DNS record pointed at the Customer Server, and keeps the Sage Connector’s outbound connection to the Customer Server open. If the Customer Server is unreachable, webhooks queue at Shopify and the Relay for a limited time (Section 5.4) and synchronisation stops until it is reachable again.
4.5 Backups beyond the Software’s own. The Software takes a nightly database dump, keeps it for fourteen days on the Customer Server, copies it to the Customer’s S3 bucket, and copies the environment file and the backup encryption key weekly to the Customer’s secrets manager. Each dump is encrypted with AES-256 on the Customer Server before it is written and is opened once with the key immediately afterwards to prove it can be restored. Those are conveniences, not a guarantee. The Customer is responsible for verifying that backups run, for running the restore drill in the Documentation after go-live, for any additional backup it needs, and for backups of Sage 100 itself, which the Software never backs up.
4.6 Accuracy of Sage data and configuration. The Software books orders into Sage 100 using the customer numbers, item codes, tax schedules, warehouse codes, shipping codes, and other values the Customer configures. The Customer is responsible for the accuracy of its Sage Records, its configuration answers, and the business rules it chooses. The Software refuses to run money-path commands against unusable configuration rather than guessing, and the Customer must complete the configuration the install asks for.
4.7 Accounts and credentials. The Customer creates and holds every credential the Software uses: the Sage user, the SQL login, the AWS roles, the operator accounts on the Customer Server, and its Shopify and Marketplace accounts. Keyway does not collect these, with one exception stated in Section 5.2. The Customer keeps operator credentials personal and strong and removes access for people who leave.
4.8 Updates. The Customer applies Updates using the Software’s update command within a reasonable time after release, and applies Security Fixes promptly. [If Allan decides updates auto-apply, replace this clause.] Keyway supports the current release and [supported release window]. An Installation more than that far behind may need to update before Keyway can diagnose a problem.
4.9 Compliance with platform rules. The Customer complies with Shopify’s terms and policies, its Marketplace seller agreements, and the laws that apply to its business, including privacy and consumer protection laws. The Customer is responsible for the content of its listings, its pricing, its tax collection, and its shipping.
4.10 Remote support access. To provide remote support, Keyway may ask the Customer to grant a scoped AWS cross-account role that Keyway can use to reach the Customer Server. The Customer decides whether to grant it and may revoke it at any time. [Allan to decide whether this role is required for the Support Schedule or optional; if optional:] Without it, Keyway’s support is limited to guidance the Customer’s own staff carry out.
4.11 Fleet beacon. The Software sends Keyway a periodic beacon carrying the Installation’s identity, version, and health fields. It carries no Customer Data. The Customer agrees to leave the beacon enabled; it is how Keyway sees that an Installation needs an Update or has gone silent, and it is how the Subscription entitlement is refreshed (Section 6.3).
5. Keyway’s services
5.1 Software and Updates. Keyway makes the Software available for download and makes Updates available to active subscribers at no additional charge. Updates are released on Keyway’s schedule; Security Fixes are released outside the normal schedule. Keyway will announce Security Fixes to the Customer’s [security fix notice channel]. The Customer applies Updates as in Section 4.8.
5.2 The Shopify app and the Relay. ForgeSync is one shared public Shopify app operated by Keyway. Because the app’s secret must stay with Keyway, the Relay sits between Shopify and the Customer Server for the functions in Section 1.3. Two consequences are stated plainly:
(a) At install, the Customer’s Shopify access credential is issued to Keyway’s Relay and delivered once to the Customer Server. The Relay does not keep it after delivery. Roughly every hour the Customer Server asks the Relay to renew the short-lived token; the renewed token passes through the Relay and is not retained.
(b) The Relay is in the runtime path for: Shopify webhooks reaching the Customer Server; opening the embedded ForgeSync admin inside the Shopify admin; storefront features the app proxy serves (such as filters, invoice and order lookups, and customer-account widgets); and the hourly token renewal.
5.3 What continues without the Relay. The Customer Server holds its own Shopify token and its own connection to Sage 100. Order export, Sage booking, inventory, and fulfilment writeback run on the Customer Server and do not call the Relay. If the Relay is unavailable, those keep running for as long as the Customer Server’s current Shopify token remains valid. The Software renews the token twenty minutes before expiry, so a Relay outage shorter than that costs nothing. A longer outage delays the Software’s calls to Shopify until the Relay returns; no order is lost, and no data is lost.
5.4 What pauses without the Relay. While the Relay is unavailable: Shopify webhooks are not delivered (Shopify retries them for up to 48 hours, and the Software’s reconcile poll picks up orders in any case); the embedded admin cannot be opened from the Shopify admin (the direct break-glass admin on the Customer Server still works); and the storefront features served through the app proxy return errors. All of these recover on their own when the Relay returns. The Support Schedule states the Relay availability target and what, if anything, is owed when it is missed.
5.5 Support. Keyway provides support as described in the Support Schedule. [Spec §2.6, what support level the Subscription includes, is still OPEN.]
5.6 Installation services. On request and for the separate charges in Section 2.7, Keyway performs the install on the Customer’s behalf. Managed install covers the Keyway side (the AWS stack, the ForgeSync server, the Shopify connection, verification and cutover) with the Customer’s Sage administrator completing the Sage 100 prerequisites on the same call; Full install adds the Sage 100 prerequisites, and requires administrator access to the Customer’s Sage server for the session. Either is a service, not part of the Subscription. Keyway schedules the session within a reasonable time of payment, the Customer provides the access listed in the Documentation, and a session that cannot proceed for want of that access is rescheduled once without charge.
5.7 No hosting, no monitoring of Customer Data. Keyway does not host the Software, does not hold the Customer’s production data or production secrets, and does not monitor the content of the Customer’s orders. The beacon and the Relay carry health and routing information; they are not a window into Customer Data.
6. Shopify-dependent terms
6.1 Shopify’s terms. The ForgeSync app is distributed through Shopify and is subject to Shopify’s terms for merchants and for apps, including Shopify’s requirements for handling protected customer data. If Shopify changes an API, a scope, a token lifetime, a billing rule, or a review requirement, Keyway may need to change the Software or this Agreement to comply, and will do so with as much notice as Shopify’s timeline allows.
6.2 Shopify Billing. Charges, approvals, currency, and refunds run through Shopify Billing. If Shopify cannot collect a charge, the Subscription is treated as lapsed under Section 7.2. Keyway does not have the Customer’s card details and cannot refund outside the Shopify mechanism. [Refund and cancellation policy: Allan to set. Spec §2.1 lists the refund and cancellation page as blocked on the lapse decisions.]
6.3 Entitlement. The Software checks that the Store’s Subscription is active. The check uses a signed entitlement token refreshed through the beacon and verified on the Customer Server without a live call, so a network or Relay problem is not treated as a lapse. A lapse produces notices; it does not stop order flow (Section 7.3).
6.4 Uninstalling. Uninstalling the ForgeSync app from the Store cancels the Subscription in Shopify and ends this Agreement’s licence at the end of the paid term (or immediately, if Shopify’s billing rules end the charge on uninstall). Uninstalling also revokes the Store’s Shopify access token, after which the Software cannot read from or write to the Store. The Customer should export what it needs from the Software before uninstalling.
6.5 Shopify is not a party. Shopify is not a party to this Agreement, has no obligations under it, and is not responsible for the Software.
7. Fees, non-payment, and lapse
7.1 Payment. Fees are due as Shopify Billing collects them. The Customer is responsible for keeping its Shopify billing method valid.
7.2 Lapse. A Subscription lapses when a scheduled charge is not approved or not collected, or when the paid term ends without renewal. Keyway will notify the Customer of a lapse through the Software and to the Customer’s contact email.
7.3 What happens on lapse. Keyway’s design rule is that a lapse never interrupts order flow into Sage 100. On lapse:
(a) for a grace period of [grace period after lapse], the Software continues to run and shows a notice in its admin; [during grace, the following pause: support / Updates / none, Allan to set];
(b) after the grace period, [Allan to set: the notice escalates only; or support and Updates stop; or the Relay stops serving the Store’s non-order functions]. Whatever is chosen, the Software does not stop exporting orders, booking them in Sage 100, or writing fulfilments back;
(c) the Customer may restore the Subscription at any time by approving the charge in Shopify, at which point the notices clear.
7.4 No refunds for partial terms. Except as the [refund and cancellation policy] states or law requires, Fees for a started term are not refunded if the Customer cancels or uninstalls before the term ends.
7.5 Disputed charges. Billing disputes go first to Keyway at [notice email] and, where Shopify’s process applies, through Shopify.
8. Intellectual property
8.1 Keyway owns the Software. Keyway and its licensors own all right, title, and interest in the Software, the Documentation, the Relay, the fleet receiver, and all Updates, including all copyright, trade secret, trademark, and other intellectual property rights. The Software is proprietary and confidential to Keyway, as its LICENSE file states. Nothing in this Agreement assigns any of it to the Customer.
8.2 Customer owns its data. The Customer owns all Customer Data and all Sage Records. Keyway claims no right in them. To the limited extent the Relay handles Customer Data in transit, it does so only as the DPA describes.
8.3 Configuration and modules. Configuration the Customer enters belongs to the Customer. Any module or code Keyway writes for the Customer belongs to Keyway unless a separate written statement of work says otherwise. [If Section 3.5 permits Customer modifications, add:] Modifications the Customer makes to the Software belong to Keyway as derivative works, and the Customer receives a licence to use them under Section 3.1.
8.4 Feedback. If the Customer gives Keyway suggestions, bug reports, or other feedback about the Software, Keyway may use it without restriction or payment. Feedback does not include Customer Data.
8.5 Trademarks. “ForgeSync” and “Keyway Systems” are Keyway’s marks. The Customer may not use them except to identify the Software as installed on its Store.
9. Confidentiality
9.1 Definition. “Confidential Information” means non-public information one party discloses to the other in connection with this Agreement that is marked confidential or that a reasonable person would treat as confidential. Keyway’s Confidential Information includes the Software, its source code, the Documentation, the Relay’s design, and Keyway’s pricing other than the public Plan prices. The Customer’s Confidential Information includes Customer Data, Sage Records, its credentials, and its business information Keyway sees while providing support.
9.2 Obligations. Each party will use the other’s Confidential Information only to perform this Agreement, will protect it with at least reasonable care, and will disclose it only to its employees, contractors, and advisers who need it and are bound to keep it confidential.
9.3 Exceptions. Confidential Information does not include information that is or becomes public through no fault of the receiving party, that the receiving party already had without restriction, that it receives from a third party without restriction, or that it develops independently.
9.4 Required disclosure. A party may disclose Confidential Information when law or a court requires it, after giving the other party prompt notice where allowed so it can seek protection.
9.5 Duration. These obligations last for the term of this Agreement and [confidentiality survival period] after it ends, and for trade secrets (including source code) for as long as they remain trade secrets.
10. Data protection
10.1 The DPA governs. The parties’ obligations for Personal Data are in the DPA, which is part of this Agreement. If the DPA and this main text conflict about Personal Data, the DPA wins.
10.2 Where data lives. Customer Data is processed on the Customer Server in the Customer’s AWS account and in the Customer’s Sage 100. Keyway’s Relay forwards data in transit and keeps no payloads. Keyway’s beacon receives health and version fields only.
10.3 Privacy notice. Keyway’s privacy policy at https://keywaysystems.com/privacy/ describes what Keyway itself collects. [The page must be public before this Agreement is used.]
11. Warranties and disclaimers
11.1 Mutual. Each party warrants that it has the authority to enter into this Agreement.
11.2 Keyway. Keyway warrants that, for the term of the Subscription, the Software will perform materially as the Documentation describes when installed and operated according to the Documentation on a Customer Server and Sage 100 that meet the prerequisites. The Customer’s sole remedy for breach of this warranty is that Keyway will use reasonable efforts to correct the non-conformity, and if Keyway cannot within a reasonable time, the Customer may terminate the Subscription and receive a refund of prepaid Fees for the unused part of the term, through Shopify Billing.
11.3 Customer. The Customer warrants that it has the rights it needs to give the Software access to its Store, Sage 100, Marketplace accounts, and Customer Data, and that its use of the Software complies with law.
11.4 Disclaimers. Except as stated in Section 11.2, the Software and the Relay are provided “as is”. Keyway disclaims all other warranties, express or implied, including implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement, to the fullest extent the law allows. In particular, Keyway does not warrant that:
(a) the Software will be uninterrupted or error-free, or that the Relay will be available at any level beyond what the Support Schedule states;
(b) Shopify, Sage 100, eBay, Amazon, or AWS will not change their products, APIs, terms, or pricing in a way that affects the Software;
(c) the Software will suit the Customer’s particular accounting practices, tax positions, or business rules;
(d) data the Customer configures or supplies is accurate.
11.5 Accounting outcomes. The Software moves data between systems the Customer controls. The Customer is responsible for its accounting outcomes: for reviewing what the Software books into Sage 100, for its tax collection and remittance, for its financial statements, and for reconciling its books. Keyway is not an accountant, tax adviser, or auditor and gives no accounting or tax advice.
11.6 Third-party systems. The Customer’s use of Shopify, Sage 100, AWS, and the Marketplaces is governed by those providers’ terms. Keyway is not responsible for their acts, omissions, outages, or changes.
12. Limitation of liability
12.1 Cap. Except for the Excluded Claims in Section 12.3, each party’s total liability arising out of or relating to this Agreement, in contract, tort, or otherwise, will not exceed the Fees the Customer paid to Keyway under this Agreement in the [12] months immediately before the event giving rise to the claim.
12.2 No indirect damages. Except for the Excluded Claims, neither party will be liable for any indirect, incidental, special, consequential, or punitive damages, or for lost profits, lost revenue, lost business, lost or corrupted data, or the cost of substitute services, even if advised of the possibility. For clarity, this includes losses arising from an order that was booked late, booked twice, or not booked, except to the extent caused by Keyway’s breach of Section 12.3(b).
12.3 Excluded Claims. The limitations in Sections 12.1 and 12.2 do not apply to:
(a) either party’s breach of Section 9 (Confidentiality) or infringement of the other’s intellectual property;
(b) [Allan and lawyer to set:] a breach of the Customer’s Personal Data caused by Keyway’s gross negligence or wilful misconduct, [which is instead capped at [separate cap, for example a multiple of 12 months of Fees or a fixed amount]];
(c) either party’s indemnity obligations under Section 13;
(d) the Customer’s payment obligations;
(e) liability that cannot be limited by law, including for fraud or for death or personal injury caused by negligence.
12.4 Basis of the bargain. The parties agree that the Fees reflect this allocation of risk and that Keyway would not offer the Software at these Fees without it.
13. Indemnities
13.1 By Keyway. Keyway will defend the Customer against any third-party claim that the Software, as delivered by Keyway and used according to this Agreement, infringes that third party’s United States patent, copyright, or trademark, or misappropriates its trade secret, and will pay the damages and costs finally awarded or agreed in settlement. Keyway has no obligation for a claim arising from: the Customer’s modifications; combination with products or data Keyway did not supply where the claim would not exist without the combination; use after Keyway told the Customer to stop; or open-source components used other than as shipped. If a claim is made or Keyway thinks one likely, Keyway may modify the Software to avoid infringement, obtain a licence, or, if neither is commercially reasonable, terminate the Subscription and refund prepaid unused Fees.
13.2 By Customer. The Customer will defend Keyway against any third-party claim arising from: Customer Data or Sage Records; the Customer’s Store, listings, pricing, tax, or shipping; the Customer’s breach of Shopify’s, a Marketplace’s, or AWS’s terms; the Customer’s violation of law, including privacy law, in its use of the Software; or the Customer’s use of the Software other than as this Agreement allows; and will pay the damages and costs finally awarded or agreed in settlement.
13.3 Procedure. The indemnified party will give prompt written notice of the claim (delay only excuses the indemnifying party to the extent it is prejudiced), give the indemnifying party sole control of the defence and settlement (but no settlement may admit fault by or impose obligations on the indemnified party without its consent, not unreasonably withheld), and cooperate at the indemnifying party’s expense.
13.4 [Caps on indemnities, if any: Allan and lawyer to set.]
14. Term and termination
14.1 Term. This Agreement starts on the Effective Date and continues while the Customer holds an active Subscription, plus any grace period under Section 7.3.
14.2 Termination for convenience. The Customer may cancel the Subscription at any time by cancelling in Shopify or uninstalling the app; the cancellation takes effect at the end of the current paid term [or on [30 days] notice, whichever is later; Allan to reconcile with the yearly term]. Keyway may terminate this Agreement for convenience on [Keyway convenience notice, spec’s wind-down design used 30 days] written notice, effective no earlier than the end of the Customer’s current paid term, with a refund of prepaid unused Fees.
14.3 Termination for cause. Either party may terminate this Agreement on written notice if the other party materially breaches it and does not cure the breach within [cure period] after written notice describing the breach. Keyway may terminate immediately on notice if the Customer breaches Section 3.4 (licence restrictions) or Section 9 (confidentiality), or if the Customer becomes insolvent, makes an assignment for the benefit of creditors, or enters bankruptcy.
14.4 Effect of termination. When this Agreement ends:
(a) the licence in Section 3 ends and the Software stops synchronising; the Customer must stop using the Software and remove it from the Customer Server, and may keep only backups required by law or its own retention policy, which remain subject to Section 3 and Section 9;
(b) the Customer keeps all Customer Data and all Sage Records. Everything the Software wrote into Sage 100 stays in Sage 100. The Software’s database on the Customer Server is the Customer’s to export before removal, and the Software includes an export command for that purpose;
(c) Keyway deletes the Store’s Relay registration, any pending credential, and the entitlement records within [30 days], as the DPA describes;
(d) the Customer revokes any cross-account role granted under Section 4.10;
(e) Sections 3.3, 3.4, 8, 9, 10, 11.4 to 11.6, 12, 13, 14.4, 17, and 18 survive, along with any accrued payment obligations.
14.5 No refund on termination for the Customer’s breach. If Keyway terminates for the Customer’s breach, prepaid Fees are not refunded.
15. Suspension for security
15.1 Keyway may suspend the Relay’s service to the Store, or the Store’s entitlement, immediately and without notice if Keyway reasonably believes that: the Store’s Installation is compromised or is attacking the Relay, Shopify, or others; the Customer’s Installation is being used in breach of Section 3.4; or continuing to serve the Store would expose other customers, Keyway, or Shopify to a security or legal risk.
15.2 Keyway will notify the Customer promptly, will limit the suspension to what the risk requires, and will lift it as soon as the risk is resolved. Because the Customer Server runs independently, a suspension of the Relay does not stop order booking into Sage 100 for as long as the Customer Server’s token remains valid (Section 5.3), but it does stop the functions in Section 5.4 and, beyond the token’s life, calls to Shopify.
15.3 Suspension is not termination and does not relieve the Customer of Fees for the period, unless the suspension is later shown to have been unjustified.
16. Changes to this Agreement
16.1 Keyway may update this Agreement, the Support Schedule, or the DPA by posting the new version at [terms URL] and giving the Customer at least [terms change notice period] written notice, except that changes required by law or by Shopify may take effect on shorter notice.
16.2 A change takes effect at the start of the Customer’s next Subscription term after the notice period, unless the Customer cancels before then. Continuing the Subscription after the change takes effect is acceptance of it. Changes will not reduce Keyway’s security or data protection commitments in the DPA without the Customer’s consent.
17. Governing law and disputes
17.1 Governing law. This Agreement is governed by the laws of the State of [governing law state], without regard to its conflict of laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
17.2 Disputes. [Allan and lawyer to choose one:]
Option A (courts): Any dispute arising out of this Agreement will be brought only in the state or federal courts located in [venue county and state], and each party submits to their jurisdiction.
Option B (arbitration): Any dispute arising out of this Agreement that the parties cannot resolve within [negotiation period] of written notice will be finally resolved by binding arbitration administered by [arbitration body] under its commercial rules, by one arbitrator, seated in [arbitration seat]. Either party may seek injunctive relief in court to protect its intellectual property or Confidential Information. Judgment on the award may be entered in any court with jurisdiction.
17.3 Injunctive relief. Each party acknowledges that a breach of Section 3 or Section 9 may cause harm that damages cannot fully repair, and that the other party may seek injunctive relief without posting a bond, in addition to other remedies.
17.4 Costs. [Whether the prevailing party recovers reasonable attorneys’ fees: Allan and lawyer to set.]
18. General
18.1 Assignment. The Customer may not assign or transfer this Agreement or the Subscription, including to a buyer of the Store, without Keyway’s written consent, not unreasonably withheld. A Subscription is tied to the Store in Shopify; a change of Store ownership in Shopify does not by itself transfer this Agreement. Keyway may assign this Agreement to an affiliate or to a successor to its business, on notice to the Customer.
18.2 Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, including outages of Shopify, AWS, Cloudflare, or the Marketplaces, internet failures, acts of government, or natural disasters, provided it uses reasonable efforts to resume. This does not excuse payment obligations.
18.3 Notices. Notices to Keyway go to [notice email] and [Keyway notice address]. Notices to the Customer go to the contact email the Customer gave during install or the Store’s Shopify owner email. Notices are effective when sent by email with confirmation of delivery, or when received if sent by courier. Routine operational messages (release notes, Security Fix announcements, lapse notices) may be sent through the Software’s admin, the beacon channel, or email.
18.4 Independent contractors. The parties are independent contractors. Nothing creates a partnership, joint venture, agency, or employment relationship.
18.5 Entire agreement. This Agreement, including the Support Schedule, the DPA, and the LICENSE and NOTICE files shipped with the Software, is the entire agreement between the parties about the Software and replaces all prior proposals, quotes, and discussions. Terms in a Customer purchase order or portal do not apply. If this main text conflicts with the Support Schedule or the DPA, the DPA wins for Personal Data and this main text wins otherwise.
18.6 Severability. If any part of this Agreement is unenforceable, the rest remains in effect and the unenforceable part is replaced with an enforceable one that comes closest to its intent.
18.7 Waiver. A party’s failure to enforce a right is not a waiver of it.
18.8 Export. The Customer will not use or export the Software in violation of United States export laws.
18.9 Government users. If the Customer is a U.S. government entity, the Software is commercial computer software and is licensed with only the rights this Agreement grants.
18.10 Counterparts and electronic acceptance. This Agreement may be accepted electronically, including by clicking accept in the Shopify install or subscription flow, and that acceptance binds the Customer as a signature would.
Support and Service Level Schedule
This Schedule is part of the ForgeSync Subscription Agreement. Capitalised terms have the meanings given there.
S1. Support channel and hours
S1.1 Support is provided by email to [support email; none is published in the source documents]. Requests must come from a contact the Customer has named. [Whether a ticket portal or chat exists: Allan to set.]
S1.2 Support hours are [support hours and days] in the [time zone] time zone, excluding [holidays observed]. Requests received outside those hours are treated as received at the start of the next support period, except that Severity 1 requests are [handled outside hours / not handled outside hours; Allan to set].
S1.3 Support is provided in English.
S1.4 [Spec §2.6 is still OPEN on what level of support the Subscription includes and whether any proactive watch survives. Until decided, this Schedule assumes reactive support only: Keyway acts on requests the Customer raises and on alerts the beacon raises. Delete this note when decided.]
S2. Severity definitions
S2.1 Severity 1: orders are not exporting to Sage 100, or the Software is booking orders incorrectly in a way that affects money (duplicate orders, wrong totals), and there is no workaround. Includes the Sage Connector being down when the cause is the Software.
S2.2 Severity 2: the Software is running but degraded: one feed (inventory, fulfilment writeback, customer sync, a Marketplace channel) has stopped or is erroring, the embedded admin or a storefront feature is not working, or a workaround exists for a Severity 1 condition.
S2.3 Severity 3: questions, configuration help, feature requests, documentation gaps, and problems with no operational impact.
S2.4 Keyway sets the severity on receipt based on these definitions and may change it as facts emerge. The Customer may ask for a review.
S3. Response targets
S3.1 Response targets are measured from receipt of a request during support hours, and count the time to a substantive human reply, not to a fix.
| Severity | First response target | Update frequency while open |
|---|---|---|
| Severity 1 | [Sev 1 response target] | [Sev 1 update frequency] |
| Severity 2 | [Sev 2 response target] | [Sev 2 update frequency] |
| Severity 3 | [Sev 3 response target] | as needed |
S3.2 These are targets, not guarantees. No resolution time is promised. Keyway will work a Severity 1 issue continuously during support hours until it is resolved or a workaround is in place.
S3.3 A restart of the Sage Connector on the Customer’s Sage server is expected to produce up to an hour of one degraded feed that self-heals on the next scheduled run. That is normal behaviour and is not a Severity 1 or 2 condition.
S4. What support covers and what it excludes
S4.1 Covered: the Software as delivered; installing Updates; diagnosing errors the Software reports; configuration questions about the Software; the Relay; the Shopify app listing and install flow; the fleet beacon.
S4.2 Not covered, and not Keyway’s to fix:
(a) Sage 100 itself: its configuration, its performance, its licensing and seat counts, its database, Custom Office, and any Sage support case;
(b) Shopify itself: the Store’s theme, checkout, apps other than ForgeSync, Shopify outages, Shopify Billing, and Shopify’s policies;
(c) the Customer’s AWS account: instance sizing, networking, IAM, cost, EBS, S3, and the availability of the Customer Server;
(d) the Customer’s Sage server: Windows, its patching, its firewall, the SSH tunnel account, and the network rules between it and the Customer Server;
(e) eBay and Amazon: their seller policies, listing rules, account health, and outages;
(f) customisations: code the Customer or a third party changed or added, and any problem an unmodified Installation does not show;
(g) data entry and business decisions: which customer number, item code, tax schedule, or shipping code an order should carry, and the correctness of the Sage Records;
(h) Installations more than [supported release window] behind the current release, until updated;
(i) Installations that do not meet the prerequisites in the Documentation, including unencrypted EBS volumes.
S4.3 Keyway may, where it is able, help with an excluded item as a separate paid service under Section 2.7 of the Agreement.
S5. Update policy
S5.1 Releases. Keyway publishes Updates as pinned releases. Each Update is applied by the Customer running the Software’s update command, which snapshots the database, applies the release, runs migrations, and verifies the Installation. A rollback command re-pins the previous code without reversing migrations. [Whether Updates auto-apply is OPEN in spec §6; this Schedule assumes Customer-initiated.]
S5.2 Security Fixes. Security Fixes are released as soon as they are ready, outside the normal release schedule, and are announced to [security fix notice channel]. The Customer should apply them promptly. Keyway may, for a Security Fix that affects the Relay or the shared Shopify app, change the Relay without notice; that does not require Customer action.
S5.3 Supported releases. Keyway supports the current release and [supported release window]. Keyway may require an Installation to update before diagnosing a problem.
S5.4 Compatibility. Keyway will make reasonable efforts to keep the Software working with Shopify’s supported API versions and with Sage 100 Premium 2022 and later, but does not promise that any particular version of either will remain supported, and may drop support for a version on [compatibility drop notice] notice.
S5.5 Signed releases. [Spec §6: signed artefacts and an advisory channel are specified but not built. Do not promise them until they exist.]
S6. Relay availability
S6.1 Target. Keyway targets [Relay availability target %] monthly availability for the Relay, measured as the percentage of minutes in a calendar month during which the Relay accepts and forwards webhook, session, proxy, and token-renewal requests, excluding Excused Downtime.
S6.2 Excused Downtime: scheduled maintenance under S8; outages of Shopify, AWS, or Cloudflare; the Customer Server being unreachable; suspension under Section 15 of the Agreement; and force majeure.
S6.3 Honest scope. The Relay is a stateless forwarding service. Its availability affects the functions in Section 5.4 of the Agreement (webhook delivery, embedded admin, storefront proxy features) and, beyond the current token’s life, the Software’s calls to Shopify. It does not affect order booking into Sage 100 while the token is valid. No availability figure is offered for the Software on the Customer Server, which Keyway does not operate, or for Sage 100, Shopify, AWS, or the Marketplaces.
S6.4 Reporting. [Whether Keyway publishes a status page or emails incident notices: Allan to set.] The Customer may ask for the Relay’s availability figure for any past month.
S7. Service credits
S7.1 [Allan to choose one:]
Option A: No service credits are offered. The availability target in S6 is a target and the remedies for persistent failure are those in Sections 11.2 and 14.3 of the Agreement.
Option B: If Relay availability in a calendar month falls below [Relay availability target %], the Customer may claim a credit of [credit % of that month’s Fees] against a future month’s Fees, up to a maximum of [maximum credit %] of one month’s Fees, by written request within [claim window] of the end of that month. Credits are the Customer’s sole remedy for missed availability. Credits are applied through Shopify Billing as [application mechanism; check what Shopify Billing allows].
S8. Maintenance windows
S8.1 Keyway may take the Relay down for scheduled maintenance during [maintenance window, day and hours, time zone], with at least [maintenance notice] notice by email. Keyway will keep scheduled maintenance short and infrequent.
S8.2 Emergency maintenance to fix a security problem may occur at any time; Keyway will notify the Customer as soon as practicable.
S8.3 During any Relay maintenance, Section 5.3 of the Agreement applies: order booking on the Customer Server continues, webhooks are retried by Shopify, and the embedded admin and storefront proxy features are unavailable until the Relay returns.
Data Processing Addendum
This Data Processing Addendum (the “DPA”) is part of the ForgeSync Subscription Agreement (the “Agreement”) between Keyway Systems LLC (“Keyway”) and the Customer. It applies to Personal Data that Keyway processes for the Customer. Capitalised terms not defined here have the meanings given in the Agreement.
D1. Definitions
D1.1 “Personal Data” means information relating to an identified or identifiable natural person that is included in Customer Data.
D1.2 “Data Protection Law” means the privacy and data protection laws that apply to the Customer’s processing of Personal Data, which may include the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), other U.S. state privacy laws, and, where the Customer is subject to them, the EU General Data Protection Regulation and the UK GDPR (together “GDPR”).
D1.3 “Controller”, “Processor”, “Business”, “Service Provider”, “Data Subject”, “Consumer”, “Sub-processor”, “Personal Data Breach”, and similar terms have the meanings given in the applicable Data Protection Law.
D1.4 “Relay Data” means the data that passes through the Relay: Shopify webhook payloads addressed to the Store, storefront app-proxy requests and responses, Shopify staff session tokens submitted for verification, the embedded-admin bootstrap request, and Shopify access and refresh tokens during delivery and renewal.
D1.5 “Server Data” means Customer Data stored or processed by the Software on the Customer Server and in the Customer’s Sage 100.
D2. Roles
D2.1 The Customer is the Controller (and, under CCPA, the Business) of all Personal Data in Customer Data. The Customer decides why and how it is processed.
D2.2 Keyway is a Processor (and, under CCPA, a Service Provider) only for Relay Data, and only for the moments it is in transit through the Relay, and for any Personal Data Keyway sees while providing remote support at the Customer’s request. Keyway processes that Personal Data only on the Customer’s documented instructions, which are this DPA and the Agreement.
D2.3 Server Data is processed by the Software on the Customer Server under the Customer’s sole control. The Customer Server is in the Customer’s AWS account, the Customer holds every credential to it, and Keyway has no access unless the Customer grants a cross-account role under Section 4.10 of the Agreement. For Server Data, the Customer is both the Controller and the party operating the processing system. Keyway is not a Processor of Server Data by reason of having written the Software.
D2.4 Shopify, eBay, and Amazon are independent parties with their own relationships with the Customer. Data they hold is governed by the Customer’s agreements with them, not by this DPA.
D3. Categories of Data Subjects and Personal Data
D3.1 Data Subjects: the Customer’s shoppers and customers on the Store; under a Pro Plan, buyers on the Customer’s eBay and Amazon seller accounts; and the Customer’s staff who use the Shopify admin and the Software.
D3.2 Personal Data processed: name; email address; phone number; billing and shipping addresses; order contents, line items, totals, tax, shipping and refund amounts; customer numbers and order identifiers; and, for staff, Shopify staff identity claims in session tokens and audit-log entries of admin actions.
D3.3 Not processed: payment card numbers or other payment instrument details are never requested, received, or stored by the Software or the Relay. Marketing preferences are not read. No special categories of Personal Data (health, biometric, religious, or similar) are intentionally processed, and the Customer will not direct the Software to process them.
D4. Purposes of processing
D4.1 The only purpose is the synchronisation of orders, refunds, customer records, inventory, and fulfilments between the Store (and, under a Pro Plan, the Marketplaces) and the Customer’s Sage 100, so that each order becomes a Sage sales order, each new customer a Sage customer record, and fulfilment and inventory flow back.
D4.2 Keyway does not use Personal Data for marketing, advertising, analytics, profiling, training, benchmarking, or resale, does not combine it with data from other customers, and does not sell or share it as those terms are defined in CCPA.
D4.3 The Software makes no automated decisions with legal or similarly significant effects on Data Subjects.
D5. Processing instructions
D5.1 Keyway will process Relay Data only to forward it to the Customer Server (or, for tokens, to deliver and renew them) and will not read, store, or analyse its content beyond what verification and routing require: the shop domain, the webhook topic, the request path, and the signature.
D5.2 Keyway will inform the Customer if it believes an instruction from the Customer breaches Data Protection Law.
D5.3 Keyway will not retain, use, or disclose Personal Data for any purpose other than the Agreement, including outside the direct business relationship between Keyway and the Customer, except as law requires.
D6. Sub-processors
D6.1 The Customer authorises the following Sub-processors for Relay Data:
| Sub-processor | What it does | Location |
|---|---|---|
| Amazon Web Services, Inc. | hosts the Relay and fleet receiver | United States |
| Cloudflare, Inc. | DNS and reverse proxy in front of the Relay | United States, global edge |
D6.2 Not Sub-processors. Shopify is the platform through which the Customer chose to operate its Store; the Customer’s own AWS account, which hosts the Customer Server, is the Customer’s, not Keyway’s; and eBay and Amazon Marketplaces are the Customer’s own seller accounts. None of them is a Keyway Sub-processor, and Keyway is not responsible for them.
D6.3 Changes. Keyway will give the Customer at least [sub-processor change notice days] written notice before adding or replacing a Sub-processor for Relay Data. The Customer may object in writing on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the Subscription and receive a refund of prepaid unused Fees. Keyway will impose on each Sub-processor data protection obligations no less protective than this DPA and remains responsible for its Sub-processors.
D7. Security measures
D7.1 Keyway’s measures (true today, as documented 2026-09-28):
(a) Encryption in transit: HTTPS on every hop from Shopify to the Relay to the Customer Server, and from the Customer Server to Shopify’s Admin API. The Sage Connector connection is an outbound-only encrypted tunnel from the Customer’s Sage server, with no inbound port opened on that server by default.
(b) The Relay is stateless for payloads: it verifies and forwards webhooks, proxy requests, and session tokens and stores none of their content. Its only persistent state is the registry of installed Stores (shop domain, the Customer Server’s URL, and a hash of the per-install secret and claim code) and a per-Store pending-credential file that exists only from the Shopify install callback until the Customer Server collects it, after which it is deleted.
(c) Shopify access credentials pass through the Relay at install and at each hourly renewal and are not retained by Keyway after delivery.
(d) Field-level encryption in the Software: shopper Personal Data on the export queue, the Shopify access and refresh tokens, and the Sage credential are encrypted at rest with the Installation’s application key (AES-256). Token columns are excluded from data exports.
(e) Single-tenant design: each Customer has its own Customer Server, database, and credentials. There is no shared database across customers.
(f) Test and production separation: Keyway develops and demonstrates on a Shopify development store with a synthetic Sage, never with Customer Data.
(g) Access logging: the Software writes an audit log of admin actions (who, what, when, which record). AWS CloudTrail in the Customer’s account records every Systems Manager session on the Customer Server.
(h) Access control: server access is by AWS Systems Manager session under the Customer’s own IAM controls. Keyway’s remote support uses only a scoped cross-account role the Customer grants and can revoke. There are no shared accounts. The embedded admin runs on Shopify staff sessions; the break-glass admin path uses per-operator credentials.
(i) The fleet beacon carries Installation identity, version, and health fields only, never Customer Data.
(j) Incident response: Keyway maintains a written incident response procedure (dated 2026-07-24) covering detection, containment, credential rotation, customer notification, and post-incident review.
D7.2 Customer’s measures (obligations, because the Customer operates the system):
(a) run the Customer Server on encrypted EBS volumes and keep the backup S3 bucket encrypted at rest. The Software separately encrypts every nightly database dump with AES-256 using a key generated on the Customer Server, and copies that key to the Customer’s secrets manager so a copy in the S3 bucket can still be opened if the Customer Server is lost; the Customer is responsible for the access controls on that secrets manager entry;
(b) restrict IAM and Systems Manager access to the Customer Server to named staff with multi-factor authentication, and keep CloudTrail enabled;
(c) keep the Customer Server patched and its HTTPS certificate valid;
(d) use per-person, strong operator credentials for the break-glass admin path, and remove access for departed staff;
(e) enforce Shopify staff account security (Shopify’s password and two-factor policy) for staff who use the embedded admin;
(f) protect the Sage user, the read-only SQL login, and the Sage server;
(g) apply Security Fixes promptly;
(h) set the retention settings in D10 to values that meet its own legal obligations.
D7.3 Keyway will not reduce the measures in D7.1 during the term without the Customer’s consent, but may improve or replace them with equivalent or stronger ones.
D8. Personnel and confidentiality
D8.1 Keyway limits access to Relay Data and to any Customer environment to personnel who need it for support or operation of the Relay, ensures they are bound by written confidentiality obligations, and gives them appropriate training. [Keyway is a small company; the lawyer may wish to reflect the actual headcount rather than imply a large staff.]
D9. Data Subject requests and assistance
D9.1 Shopify’s mechanism. When a Data Subject makes a request through Shopify, Shopify sends the ForgeSync app a customers/data_request, customers/redact, or shop/redact webhook. The Relay forwards it to the Customer Server, where the Software records it, alerts the Customer’s operator, and lists it in the compliance command. The Software records these requests; it does not act on them by itself.
D9.2 The Customer’s part. The Customer, as Controller, is responsible for answering the request within Shopify’s window (30 days from the webhook) and any shorter period Data Protection Law requires. For a data request, the answer comes from the Customer’s Sage and ForgeSync records. For a redaction, the Customer removes the person’s records from the Customer Server using the compliance command and decides, under its own retention policy and accounting obligations, what happens to the corresponding Sage Records, which are the Customer’s books. The Customer closes the request in the compliance command.
D9.3 Keyway’s part. Keyway holds no Personal Data about the Customer’s shoppers that a request could reach, because the Relay stores no payloads. Keyway will assist the Customer, on request and within the support hours in the Support Schedule, with the technical steps on the Customer Server, and will forward to the Customer any Data Subject request that reaches Keyway directly, without responding to it except to say that the Customer is the Controller.
D9.4 Other assistance. Taking into account the nature of the processing and the information available to it, Keyway will provide reasonable assistance with the Customer’s data protection impact assessments and consultations with supervisory authorities, where they concern Relay Data. Keyway may charge for assistance beyond what is reasonable in scope.
D10. Retention and deletion
D10.1 Relay. The Relay retains no webhook payloads, proxy content, or session tokens. It retains the Store’s registry entry and, transiently, a pending credential until the Customer Server collects it.
D10.2 Customer Server. Retention on the Customer Server is the Customer’s setting. The defaults shipped with the Software are:
(a) order payloads on the export queue: held until the order is booked in Sage 100 and then for 90 days, configurable per Installation;
(b) sync logs and errored payloads: their own configurable retention periods;
(c) nightly database dumps: 14 days locally, plus the copy in the Customer’s own S3 bucket, whose lifecycle the Customer sets;
(d) [Marketplace buyer Personal Data: the spec records a 30-day purge after order close, attested to Amazon; the answers doc gives 90 days as the queue default. Allan to confirm the actual module default and state it here.]
D10.3 Sage Records. Records the Software creates in Sage 100 are the Customer’s books and follow the Customer’s own retention policy. The Software does not delete Sage Records.
D10.4 On termination. Within [30 days] after the Agreement ends, Keyway will delete the Store’s Relay registration, any pending credential, the entitlement records, and the beacon history for the Installation, except to the extent law requires Keyway to keep a record, in which case Keyway will keep it confidential and isolated. Because Keyway holds no Server Data, there is nothing for Keyway to return; the Customer exports and keeps its own Server Data under Section 14.4 of the Agreement. On request, Keyway will confirm deletion in writing.
D11. Personal Data Breach
D11.1 Keyway will notify the Customer without undue delay and in any case within [72 hours] after becoming aware of a Personal Data Breach affecting Relay Data or caused by Keyway’s access to the Customer environment. The notice will describe what is known: the nature of the breach, the categories and approximate number of Data Subjects and records, the likely consequences, and the measures taken or proposed. Keyway may give the notice in stages as facts emerge.
D11.2 Keyway will cooperate with the Customer’s investigation and its notifications to authorities and Data Subjects, and will not notify authorities or Data Subjects about the Customer’s Personal Data itself unless law requires.
D11.3 A breach of the Customer Server, the Customer’s AWS account, the Customer’s Sage 100, or the Customer’s Shopify or Marketplace accounts that is not caused by Keyway is the Customer’s to handle. Keyway will assist under the Support Schedule and its incident response procedure, including rotating any Relay-side credentials for the Store.
D12. Audit
D12.1 On the Customer’s written request no more than once in any twelve months, Keyway will answer a reasonable written security questionnaire about the Relay and Keyway’s practices, and will make available the documentation reasonably necessary to demonstrate compliance with this DPA, subject to Section 9 of the Agreement.
D12.2 Keyway does not permit on-site audits of its facilities or its Sub-processors’ facilities except where Data Protection Law gives the Customer or a supervisory authority a right to one that written responses cannot satisfy, in which case the audit will be at the Customer’s cost, on at least [audit notice period] notice, during business hours, by an auditor bound by confidentiality, and limited to what is needed for Relay Data. [Note: the annual penetration test is currently an internal self-run, per spec §5; do not promise a third-party test report.]
D12.3 The Customer can audit the Customer Server itself at any time; it is the Customer’s.
D13. International transfers
D13.1 The Relay and Keyway’s operations are in the United States. Relay Data is processed in the United States. Server Data is processed in whichever AWS region the Customer chooses for the Customer Server.
D13.2 [If a customer subject to GDPR or UK GDPR appears: attach the EU Standard Contractual Clauses (Module 2, controller to processor) and the UK International Data Transfer Addendum, with Keyway as data importer, and complete their annexes from D3, D4, and D7. Until then this clause states only that Keyway will enter into those clauses on request from such a customer.]
D14. CCPA and U.S. state privacy laws
D14.1 Where the CCPA applies, Keyway is a Service Provider to the Customer as a Business. Keyway certifies that it understands and will comply with the restrictions in this D14.
D14.2 Keyway will not: sell or share Personal Data; retain, use, or disclose Personal Data for any purpose other than the business purpose in D4 and as the Agreement permits; retain, use, or disclose Personal Data outside the direct business relationship between Keyway and the Customer; or combine Personal Data received from the Customer with Personal Data it receives from another person or collects itself, except as CCPA regulations permit for a Service Provider.
D14.3 Keyway will notify the Customer if it determines it can no longer meet its obligations under CCPA. The Customer may take reasonable and appropriate steps to stop and remediate unauthorised use of Personal Data, including the audit rights in D12 and the objection rights in D6.
D14.4 Keyway will comply with applicable CCPA obligations and provide the same level of privacy protection CCPA requires of Businesses, and will assist the Customer with Consumer requests under D9.
D14.5 Equivalent terms apply under other U.S. state privacy laws that treat Keyway as a processor for the Customer, to the extent those laws apply to the Customer.
D15. GDPR
D15.1 Where the Customer is subject to GDPR, this DPA is intended to satisfy Article 28(3), and Keyway will process Personal Data only on the Customer’s documented instructions (D5), ensure confidentiality of its personnel (D8), implement the measures in D7, respect the conditions for Sub-processors in D6, assist with Data Subject rights (D9), assist with security, breach notification and impact assessments (D9, D11), delete or return Personal Data at the end of the services (D10), and make available the information needed to demonstrate compliance and allow audits (D12).
D15.2 The subject matter, duration, nature and purpose of the processing, and the types of Personal Data and categories of Data Subjects, are as set out in D3, D4, and the Agreement’s term.
D16. General
D16.1 This DPA lasts as long as Keyway processes Personal Data for the Customer and survives termination of the Agreement until deletion under D10 is complete.
D16.2 Keyway’s liability under this DPA is subject to Section 12 of the Agreement, including any carve-out in Section 12.3(b).
D16.3 If this DPA conflicts with the Agreement about Personal Data, this DPA wins. If it conflicts with Standard Contractual Clauses attached under D13, those clauses win for the transfers they cover.
End of draft. Not for customer use until every bracket is resolved and a lawyer has reviewed the whole text.