Processing agreement

In force from 29 September 2026. The French version is the reference version.

This agreement says what we do with the personal information the organisation entrusts to Arrivos, who else touches it, and what we owe the organisation while we hold it. It is the written mandate the Act respecting the protection of personal information in the private sector asks for when a business has someone else process personal information on its behalf, and it is part of the terms of use. Where a signed service agreement says something different, the signed agreement prevails.

1. The parties

Logiciels Writ ("we", the service provider) processes personal information on behalf of the organisation that signed the service agreement ("the organisation"). Benjamin Garcia is the person in charge of the protection of personal information on our side: [email protected].

2. Who decides and who carries out

The organisation decides what is collected, why, and how long it is kept within the limits of the service; it answers for that to the people concerned. We only carry out what the service does for it, and we never use its information for our own purposes: not to build a product, not to profile anyone, and not to train an artificial-intelligence model. This agreement does not transfer ownership of anything: the organisation's data stays the organisation's.

3. What we process, for what, and for how long

• What. The names and Auphan usernames of the people who sign in, their sign-in sessions, the supplier invoices the organisation imports and the lines they contain, the transfers between its shops with the reasons written when one is declined, the mail addresses its shops send filings to, the connection to a shop's Outlook mailbox, the record of every document filed into the point of sale, and the record of administrative changes. Auphan passwords are never written down by the server: at sign-in each one is encrypted, under a key only the server holds, into a cookie bound to that person's session, and is opened in the server's memory only for the length of one operation.
• For what. Reading an invoice, matching it against the point of sale's catalogue, filing it, moving stock between shops, saving a copy where the organisation asks, sending the mail that follows a filing, and answering later questions about who did what.
• For how long. The periods in the privacy notice, which the server enforces by itself every night. The organisation's own data is erased when the agreement ends, on the terms in section 12.

4. Our instructions

We process personal information only as the service does, on the organisation's instructions, and for nothing else. Should a law oblige us to hand something over, we tell the organisation before we do unless the law forbids it. We do not communicate the organisation's information to anyone who is not named in section 6.

5. Confidentiality

Only the people who need it to run and repair the service reach the organisation's information, under a confidentiality obligation that survives the end of their work. On our side that is the smallest possible number of people, named in the service agreement.

6. The providers we use

Each of the providers below receives only what its task needs. We stay answerable to the organisation for what they do with it, and we tell the organisation before adding or replacing one.

• Writ runs the operations in the Auphan point of sale on the organisation's behalf: it receives the Auphan username and password for the length of each operation, and the invoice lines to file. When a scanned PDF has to be turned into text, a Writ service reads it too.
• OpenRouter, and the provider of the artificial-intelligence model it calls, receive the text of an invoice in the three cases set out in section 7.
• Microsoft (Microsoft Graph) sends the mail that follows a filing, from the Outlook mailbox the shop connected. The app can send mail and read the mailbox's name and address; it never reads, moves or deletes messages.
• Cloudflare protects access to the site and carries the encrypted traffic to our server; it sees the user's IP address.
• The server's hosting provider supplies the machine the service runs on.
• The backup storage provider keeps copies of the server's backups. They are encrypted on our server before they leave it, with a key the provider does not hold, so it cannot read them.

Auphan, the organisation's point-of-sale provider, and the organisation's own Microsoft 365 account are not our providers: the organisation deals with them directly, and the service acts inside them with the credentials the organisation gives it.

7. The artificial-intelligence provider

The text of an invoice is sent to the model in three cases, and in no other:

• the first time a supplier is seen, to write the rules that then read that supplier's invoices without artificial intelligence;
• when a person of the organisation asks for those rules to be written again or repaired, from an invoice they misread and the corrections that person made to it;
• when a person asks why an invoice's total does not agree and arithmetic alone cannot explain it, together with that invoice's lines.

In the first two cases, the examples of that same supplier the vault keeps to check its rules may be sent with it: the text of at most its last five filed invoices and the figures the shop confirmed on them. What is sent is what a supplier invoice prints: the supplier, the dates, the products, the quantities, the prices and the taxes. No Auphan password, nothing else from the vault, no invoice of another supplier and no list of the people who signed in is ever sent. The model is called through an account whose privacy settings refuse providers that keep or train on what they receive, and the service works with the rules the model wrote, so a supplier already known is read without any invoice leaving the server.

8. Information processed outside Quebec

The providers in sections 6 and 7 may process the information they receive outside Quebec and outside Canada. Before communicating personal information outside Quebec we assess, as the law requires, whether it will be adequately protected there, taking the sensitivity of the information, its purpose, the protections around it and the law of the place into account. That assessment is written down and given to the organisation on request.

9. What protects it

The measures the service keeps in force: traffic encrypted in transit; every stored credential (the point-of-sale connection, the Outlook tokens, the model key) sealed with AES-256-GCM under a key held only on the server and not in the source code; the vault of filed receipts encrypted in the browser with a key the server never holds; each shop's data reachable only by that shop's organisation; sessions that expire and can be revoked; a second factor available on the administrator's account; limits on sign-in attempts and on calls to the point of sale; a record of administrative changes kept for two years; nightly backups, encrypted on the server before any copy of them leaves it.

10. Incidents

We tell the organisation without delay of any confidentiality incident touching its information, with what we know of what happened, what is affected and what we have done. We keep a register of incidents, and we help the organisation make the notices the law asks of it. Where the incident presents a risk of serious injury, the Commission d'accès à l'information and the people concerned are notified with diligence.

11. Helping the organisation answer a person

A person may ask the organisation for access to their information, its correction, or that it stop being circulated. The organisation answers; we give it what it needs within ten days of its request, and the service already exports and erases an organisation's data on its own. A person who writes to us directly is pointed to the organisation.

12. End of the agreement

When the agreement ends, the organisation has 30 days to export its data, and we help it do so. No later than 30 days after the agreement ends we erase all of the organisation's data from our server, including the encrypted copies of the vaults, the pending PDFs and its shops' Outlook connections, and confirm in writing what was erased. Backup copies are erased as they rotate out in the normal way, at the latest 12 months after the erasure.

13. Showing that this is true

On the organisation's written request, and at most once a year, we give it the evidence that these measures are in force: the operating runbook's relevant sections, the list of providers with their regions, and a written attestation signed by the person in charge. An organisation that asks for an audit by a third party bears its cost, and it takes place at a time that does not disturb the service.

14. Changes

We may change this agreement by publishing the new version at this address. A change that widens what is processed, or that adds a provider, is announced to the organisation at least 30 days before it applies, and the organisation may end the agreement rather than accept it.

15. Signature

This agreement is signed once with each organisation, in two copies, and names the people who sign for it. Until it is signed, the version published here is what governs, and the organisation is asked to sign it before its first shop files an invoice.

16. Contact

Logiciels Writ, attention Benjamin Garcia: [email protected].