Security & Data-Handling Brief

This brief provides a plain-language overview of how Pennix intends to handle firm and client data. It is not a certification, audit report, legal opinion, or substitute for the final Data Processing Agreement, Terms, Privacy Policy, or firm-specific review.

01Access and permissions

Access to firm and client data should be limited to authorised people, systems, and service providers that require access to operate, support, secure, or maintain the Pennix service.

Our production environment applies controls including:

• User roles and permissions
• Administrative-access rules
• Internal support access
• Authentication requirements
• Password requirements
• Session controls
• Account deactivation procedures
• Access-review frequency
• Logging of privileged actions
• Emergency-access procedures

Access is restricted to authorised Pennix personnel and systems on a least-privilege basis, with authentication, session controls, and logging of privileged actions. Specific role and access configurations are maintained internally and available to customers on request.

Pennix may prepare client-communication drafts within the purchased package capacity. No statement on this page should be interpreted as a promise that messages are sent automatically. Firm review, approval, and sending controls must match the verified product configuration.

02Hosting, storage, and data location

Pennix may use third-party infrastructure providers to host, store, transmit, and process firm and client data.

Data is processed and stored in the United States. If regional data residency is required, contact us to discuss available options.

03Encryption and transmission

Pennix uses appropriate technical measures to protect data in transit and at rest, summarised below.

These measures reflect our current configuration and the managed services we use; further technical detail is available to customers on request.

04Retention, export, and deletion

The table below summarises how long the main data categories are retained and how they are deleted.

The treatment of unused package capacity is governed by the Pennix purchase terms and is separate from the retention or deletion of customer data.

Customer export and deletion request procedures: requests may be made to info@getpennix.ai, and client-file data is returned or deleted in line with the applicable Data Processing Agreement, typically within ~30 days.

05AI processing and model providers

Pennix may use third-party AI, document-processing, storage, infrastructure, and communication services to perform parts of the Pennix workflow.

Where providers offer configuration options, Pennix configures them so customer data is not used to train third-party foundation models, consistent with our Terms and DPA. Applicable provider terms are available on request.

06Subprocessors

Subprocessors are third-party service providers that may process personal data on behalf of Pennix while supporting the operation of the service.

For each subprocessor, Pennix maintains:

• Legal provider name
• Service provided
• Data categories processed
• Processing purpose
• Processing location
• Contractual role
• Link to the provider’s privacy or security information
• Whether the provider may appoint additional subprocessors

Pennix engages a limited set of vetted subprocessors — cloud infrastructure, storage, email delivery, document processing, and AI model processing — under written contract. The current named list, with roles and locations, is available to customers on request and in the applicable Data Processing Agreement.

Material changes to the subprocessor list are notified to customers with a reasonable opportunity to object, as set out in the Data Processing Agreement.

07Logging, monitoring, and auditability

Pennix should maintain appropriate records of account activity, processing events, permission changes, administrative access, and system actions where technically and legally appropriate.

Specific log detail, retention, and availability are provided to customers on request.

08Security incidents

Pennix must maintain an internal process for assessing, containing, documenting, and responding to suspected security incidents involving the service or customer data.

Our incident-response process addresses:

• Incident-response owner
• Internal escalation procedure
• Technical containment process
• Customer notification process
• Notification timelines
• Regulator-notification responsibilities
• Evidence preservation
• Post-incident review
• Subprocessor incident escalation

Pennix maintains an internal process to assess, contain, document, and respond to suspected security incidents, including notifying affected customers without undue delay where required. Further detail is available on request and in the Data Processing Agreement.

09Business continuity and backups

Pennix must define how it protects service availability, restores systems, and recovers customer data following an outage, technical failure, or provider disruption.

Pennix does not guarantee specific uptime or recovery times unless those commitments are included in a signed service agreement.

10Customer responsibilities

Each customer remains responsible for determining whether Pennix is appropriate for its legal, professional, regulatory, contractual, and client-confidentiality obligations.

Customers are responsible for:

• Having a lawful basis to upload and process client information
• Providing required client notices
• Obtaining any required client consents
• Limiting user access to authorised personnel
• Protecting login credentials
• Reviewing Pennix-assisted output
• Reviewing client-email drafts before sending
• Maintaining professional judgment and responsibility
• Following applicable tax, accounting, privacy, and professional rules
• Removing data that should not be processed through Pennix
• Promptly reporting suspected unauthorised access

Pennix does not replace the customer’s professional review, tax judgment, legal obligations, or responsibility to clients.

11Client communication controls

Pennix packages include capacity for drafting client emails. Drafting is not the same as sending.

Unless the live product and account configuration have been separately verified to support automatic sending, all Pennix-generated client communication must be treated as a draft for firm review and approval.

Current sending and approval controls: Pennix generates client communications as drafts that are held for firm review. Outbound sending is controlled by the firm’s designated authorised approver, and automatic sending is not promised.

12Product and professional boundaries

Pennix is an AI-assisted intake-processing tool for tax and accounting firms.

Pennix does not:

• Prepare tax returns
• Provide tax advice
• Provide legal advice
• Replace professional review
• Replace professional judgment
• Guarantee document accuracy
• Guarantee file readiness
• Guarantee client responses
• Guarantee time or cost savings
• Guarantee regulatory compliance
• Guarantee uninterrupted availability
• Automatically approve client communication

All Pennix-assisted output should be reviewed under the firm’s normal professional and quality-control procedures.

13Certifications, attestations, and security claims

Pennix does not currently claim any certification, audit result, regulatory approval, or formal security attestation unless it is specifically identified below with its scope, date, and issuing body.

Pennix does not use “bank-grade,” “military-grade,” or similar promotional security language.

If a certification, audit, or attestation is obtained later, this page must identify the exact scope, date, issuing body, and any limitations.

14Privacy and data-processing terms

The final Privacy Policy, Terms, Data Processing Agreement, and any customer-specific data-handling commitments must be read together.

Pennix’s legal and data-processing framework covers:

• Pennix legal entity
• Registered address
• Privacy contact
• Security contact
• Data-protection contact, if applicable
• Governing law
• Contracting jurisdiction
• Data-controller and data-processor roles
• International-transfer mechanism
• Data-subject request process
• Complaint process

Current legal and privacy details:

15Requesting additional information

Before using Pennix with sensitive client information, request and review the current:

• Security and Data-Handling Brief
• Privacy Policy
• Terms
• Data Processing Agreement
• Subprocessor list
• Retention and deletion schedule
• Incident-notification terms
• Hosting and data-location information

Privacy contact: info@getpennix.ai

Security contact: info@getpennix.ai

← Return to the Pennix site