# WorkApproved Terms of Service

**Last updated:** 22 October 2026

These terms are an agreement between you and **Stone Pritchard Limited**, a New Zealand company, trading as WorkApproved ("**WorkApproved**", "**we**", "**us**").

- NZBN 9429053953216 (company number 9458360)
- Registered office: 2 Navigation Drive, Whitby, Porirua 5024, New Zealand
- GST number: 149-671-234
- Contact: hello@workapproved.app. Security problems: security@workapproved.app.

"**You**" is the business or organisation that signs up, or that owns the Xero organisation connected to WorkApproved.

**The short version.** This summary is not part of the agreement. The numbered terms below are.

- WorkApproved is for businesses and organisations, not consumers.
- You make every approval decision. We record it and write it back to Xero. We never approve anything on our own judgement.
- Risk indicators are aids to help you spot problems. They are not a guarantee.
- For organisations in New Zealand, register checks show what a public business register records, with its source and the date. They are information, not advice.
- You pay per Xero organisation per month. You can cancel any time, effective at the end of the period you've paid for.
- We do our best to keep the service running, but we don't guarantee it.
- Our liability is capped at the fees you paid in the 12 months before the claim.
- New Zealand law applies.

---

## 1. About these terms

1.1 **Accepting.** You accept these terms when you sign up (we record which version you accepted, and when), connect a Xero organisation or use the service, whichever is first. If you accept for a business, you confirm you have authority to bind it.

1.2 **What makes up the agreement.** These terms, including Schedule 1 (Data processing) and Schedule 2 (Plans and retention), plus our Privacy Policy and our list of sub-processors. If there's a conflict, the order is: Schedule 1, then the main terms, then the other documents.

1.3 **If an accounting firm pays for you.** A firm may pay for your organisation under our Partner Terms. You still accept these terms for your own use of the service and your own data. The firm pays the fees. The firm and you are separate parties. See clause 7.10.

1.4 **Business customers only.** You confirm that you're acquiring the service for the purposes of a business or organisation, and not as a consumer.

1.5 **Where you may sign up.** Sign-up is open to businesses in most countries. We don't open accounts for organisations in countries under comprehensive sanctions.

1.6 **Where the service runs.** The service is run from New Zealand. Your data is held in Australia and processed by providers in other countries (see our Privacy Policy). If your local law restricts where your data may be held, or requires terms we don't offer, don't use the service until you've checked with your own adviser. You're responsible for that check.

## 2. The service

2.1 **What it does.** WorkApproved connects to your Xero organisation, picks up documents that have been submitted for approval, routes them to the people your workflows name, records each decision, and writes the result back to Xero. When a document is fully approved, we create an audit certificate and attach it to the document in Xero. We send emails (including to approvers who don't have a login) so people can act.

2.2 **We are not Xero.** WorkApproved is independent of Xero and isn't endorsed by it. "Xero" is a trade mark of Xero Limited. The service depends on Xero's systems and rules. Xero's limits (for example the number and size of attachments a document can hold, or how many calls we can make per day) can delay or stop an approval. If Xero is down, changes its rules or ends our access, we aren't responsible for the effect on you, but we'll tell you what we can.

2.3 **Changes.** We improve the service all the time. We may add, change or remove features. If we remove a feature that you pay for, we'll give you at least 30 days' notice, and you can cancel and get a refund of any fees you've paid for the unused part of the period.

2.4 **Languages.** Some screens may be machine-translated. The English version of these terms and of every certificate is the one that governs.

## 3. Your account and your people

3.1 **Keep access secure.** Administrators and account owners must use two-factor authentication (an authenticator app or a passkey). You're responsible for what happens under your logins and for keeping them safe. Tell us promptly at security@workapproved.app if you think someone else has got in.

3.2 **Your people.** You decide who your administrators, approvers, auditors and viewers are. You must make sure each person is allowed to act for you, and that you've told them (and anyone else whose information you load into the service) that WorkApproved will handle their personal information for you.

3.3 **Approvers without a login.** An email approver acts through a link we send to their email address. Anyone who controls that mailbox, or has the link, can act as that person. That decision counts as your decision. Keep those mailboxes secure, and remove approvers who shouldn't act any more.

3.4 **Accounting firm staff.** If an accounting firm pays for your organisation, its people can see and manage everything in your organisation, including your bills and approvals. You're told this before you agree. Those people appear in your People list under their own names. You can end the firm's access by moving to your own billing (see the Partner Terms and clause 7.10).

3.5 **Accuracy.** The information you give us (sign-up details, billing details) must be correct and kept up to date.

## 4. Your decisions are yours

4.1 **You own the approval decisions, workflows and rules.** Every approval, rejection, query and comment is made by someone at your organisation (or by a rule you set up). Your workflows, auto-approval rules, thresholds, risk settings, self-approval settings and standing approvals are your choices. WorkApproved records and carries them out, and writes the outcome to Xero. **We never approve, reject or change anything on our own judgement, and nobody at WorkApproved makes a decision for you.**

4.2 **Auto-approval.** An auto-approval rule does only what you told it to. You are responsible for the rule, including its limits and conditions. We'll warn you about some risky settings (for example a rule with no amount ceiling), but a warning is not a review of your controls.

4.3 **Risk indicators are aids, not guarantees.** The risk indicators flag some common signs of error and fraud, such as duplicates, changed bank details or edited PDFs. They can miss things, and they can flag things that are fine. We don't claim to detect or prevent fraud or error. You remain responsible for reviewing each document and for the decision you make. A "no flag" result isn't a statement that a document is correct. For organisations in New Zealand they include what public business registers record about a supplier or customer (clause 12.4).

4.4 **The certificate is a record, not an opinion.** The audit certificate records who decided what and when, based on what we received from Xero and from your people. It isn't an audit, a legal opinion, or accounting, tax or financial advice. WorkApproved isn't an accounting firm or a licensed adviser.

4.5 **AI agents and the MCP connection.** If you switch on the MCP connection (off by default), you decide whether an AI agent can read or approve (read-only is the default when it's on). Actions by an agent are recorded as made through your login or token and are your decisions. We don't use AI to make decisions for you, and we don't hold your AI provider keys.

4.6 **Your own controls.** WorkApproved is one control in your overall process. You're responsible for your own policies, for removing approval rights in Xero from people who shouldn't have them, and for payments you make.

## 5. Your data

5.1 **It's yours.** You own your data: what comes from Xero, what you enter, your decisions, comments and attachments ("**Your Data**"). We don't claim ownership of it.

5.2 **What we may do with it.** You give us permission to use Your Data only to provide, secure, support and fix the service for you, and as the Data Processing Schedule and our Privacy Policy say. We don't sell it, and we don't use it for advertising. We don't use Your Data, including data from Xero, to train AI or machine-learning models.

5.3 **Usage information.** We may keep and use counts and measurements about how the service is used (for example the number of documents processed and storage used) to run, secure, price and improve it. This doesn't include the content of Your Data.

5.4 **Bill history.** If you switch on duplicate checking using past bills, we import up to the last 12 months of bill details (details only, no attachments) and keep that history up to date from Xero. You agree to this when you switch it on. If you withdraw that consent, we delete the history.

5.5 **Our staff.** A small number of WorkApproved staff can access customer organisations to give support, fix faults and keep the service secure. A support agent looks inside your organisation only while you have switched support access on, and then only to look. Our owner and technical staff may also access an organisation where that is needed to fix a fault or protect the service. Staff can't approve, reject or change a workflow for you. Staff access is logged inside WorkApproved.

5.6 **Your authority.** You confirm you're allowed to connect your Xero organisation, to load the personal information in it into WorkApproved, and to have us process it. If you disconnect Xero, or ask Xero to revoke access, we stop syncing.

5.7 **Where Your Data is held.** Our database is in Sydney, Australia. Your files (attachments and certificates) are stored with Cloudflare R2, whose location Cloudflare doesn't guarantee. See Schedule 1 and the sub-processor list.

## 6. Using the service

6.1 **Acceptable use.** You must not: break the law using the service; try to get into another customer's data or bypass our security; probe, scan or overload the service; copy, reverse-engineer or resell it; use it to simulate Xero user actions in ways Xero's terms don't allow; or upload malicious code or material you have no right to hold.

6.2 **Fair use.** There are no hard limits on any plan. If an organisation's use is more than four times the average for organisations on its plan, we'll contact you to agree a resolution, such as moving to the Plus plan or a custom price. If we can't agree a resolution, we may suspend your account, make it read-only, or cancel it.

6.3 **Suspension.** We may suspend or limit access if you seriously breach these terms, if your use puts the service or other customers at risk, if a payment you made is charged back or disputed (clause 16.2), or if the law requires it. We'll tell you why and, where we can, give you a chance to fix it first.

## 7. Plans, prices and billing

7.1 **Plans.** Standard and Plus are described on our pricing page and in Schedule 2. Prices are per Xero organisation per month, with unlimited users.

7.2 **Prices.** Prices are per Xero organisation per month and may differ by region. The price that applies to you is on our pricing page and is shown before you pay. Prices are shown without tax.

7.3 **Tax.** Prices exclude tax. We add GST, VAT or other sales tax where it applies, worked out by our payment provider (Stripe Tax) from your billing details, and you must give us a valid tax number where one applies. You pay taxes and duties that apply to the fees, other than taxes on our income.

7.4 **Free trial.** New accounts get a 7-day trial. We require a card at sign-up. When the trial ends we start charging for the plan you chose unless you cancel first. After the trial you're on the plan you chose. An accounting firm that pays for you may extend your trial, up to 30 days from its start. If you joined through a firm's public link and the firm hasn't yet agreed to pay for you, you have a 7-day trial with no card, and then you add your own card or stop. We may send a reminder before the trial ends, but we are not required to, and not receiving one does not change when the trial ends or the charge.

7.5 **How we bill.** Monthly in advance, per Xero organisation connected to your account. You pay by card through Stripe. We issue tax invoices.

7.6 **Changes during a month.** If you add or remove an organisation, we adjust the charge pro rata for the rest of the period. If you change plan, the change applies from the start of your next billing period and we don't credit or charge the difference for the current one.

7.7 **Late or failed payment.** If a card payment fails, we (through Stripe) will try again and tell you. If the final retry fails, we may make your account read-only. Where we have agreed to invoice you, an invoice is due 7 days after it's issued. If it's still unpaid 14 days after the due date, we may make your account read-only. Read-only means you can look at your records, but approvals stop. We tell you before we do. We restore full access when you've paid. If an account stays read-only for 60 days without payment, we treat it as cancelled and clause 8.2 applies: we keep your data for 90 days from that date, warn you about 30 and 7 days before the deletion date, and then delete it.

7.8 **Price changes.** We can change prices by giving you at least 30 days' written notice by email to your account administrators. A change applies from the next billing period after the notice ends. If you don't accept it, you can cancel before it takes effect and you won't pay the new price.

7.9 **Cancelling.** You can cancel at any time, in the app (on the Billing page). It takes effect at the end of the period you've already paid for, and you keep access until then. We don't refund the unused part of a paid period, except: (a) if we end the service without cause or remove a feature you pay for (clause 2.3 and 16.3); (b) where an accounting firm takes over paying for you (see the Partner Terms); or (c) where the law says we must.

7.10 **If a firm pays for you.** The firm pays the fees for your organisation at the partner price and bills you itself if it wishes. We never bill you for that organisation. If the firm stops paying, you can move to your own account and add your own card. We never stop service mid-period because of that change.

## 8. Keeping and deleting your data

8.1 **Retention.** The default rules are in Schedule 2. In short: attachment copies are working copies, kept for up to 18 months from approval on Standard (you can choose shorter); the audit log is kept for 3 years on Standard; Plus keeps them longer. When an attachment copy is deleted, we keep its name, size and fingerprint (SHA-256 hash) so certificates still verify. The original attachments stay on the document in Xero. A certificate includes the pages of PDF and image attachments, and we keep certificates while your organisation is on WorkApproved (Schedule 2), so those pages are kept with it.

8.2 **Deletion after you cancel.** After your paid period ends, your access stops. We keep your organisation's data for 90 days in case you come back, and then delete it. We email your account's owners and billing contact about 30 days and again about 7 days before the deletion date. You can ask us to delete earlier. Deletion has these limits, which are set by our retention rules and the law:
 - audit log rows for a deleted organisation are kept for 12 months, can be read only by WorkApproved support, and are then deleted automatically;
 - billing and tax records are kept for as long as the law requires (currently 7 years in New Zealand);
 - copies in backups are removed as backups expire.

8.3 **Xero copies.** Certificates, and anything we wrote to Xero, stay in your Xero organisation. They're yours, and deleting our copy doesn't remove them.

## 9. Support and availability

9.1 **Support.** You can email us at hello@workapproved.app. We'll do our best to help, but support is provided on a reasonable-efforts basis and we don't commit to support hours or a response time.

9.2 **Availability.** We use commercially reasonable efforts to keep the service available and to fix problems quickly. We don't guarantee uptime or that the service will be error-free or uninterrupted. We may carry out maintenance, with notice where we can.

9.3 **If a firm supports you.** If a firm pays for you, your help links may go to the firm first.

## 10. Privacy and data protection

10.1 Our Privacy Policy explains how we handle personal information. Schedule 1 applies where we process personal information for you (for example about your approvers and suppliers).

10.2 If there's a data breach affecting you, we'll follow clause 3.6 of Schedule 1.

## 11. Confidentiality

Each of us will keep the other's non-public information confidential, use it only for this agreement, and disclose it only to people who need it and are bound to keep it confidential, or where the law requires. This doesn't cover information that's public, already known, or independently developed. Your Data is also protected by Schedule 1.

## 12. Intellectual property

12.1 We own the service, its software, designs, and the WorkApproved name and logo. You get a non-exclusive, non-transferable right to use the service for your own business while this agreement runs.

12.2 You own Your Data (clause 5.1). You may keep and use certificates after you cancel.

12.3 If you give us feedback, we may use it without owing you anything.

12.4 **Public register data.** For organisations in New Zealand, the service may show you information from public registers run by the Ministry of Business, Innovation & Employment ("**MBIE**"), such as the Companies Register and the New Zealand Business Number Register ("**Register Data**"). This includes what a register records about a supplier or customer, for example whether it is registered, in liquidation, in receivership, in voluntary administration or removed. Wherever we show Register Data, we acknowledge MBIE as its source in the form "Data sourced from the [Register name]", with the date and time we fetched it from the register or last refreshed it.

(a) **Information, not advice.** Register Data is shown as the register records it, as at the date and time shown. It may be incomplete, out of date or wrong. It is not a credit check, an assessment of anyone's finances, a recommendation or advice. A register entry that raises no flag doesn't mean a supplier or customer is safe to deal with, and a flag means no more than what the register shows. You remain responsible for your decisions about who you approve, pay or supply.

(b) **How you may use it.** You may use Register Data only for your own business, within the service, and in line with the law, including the Privacy Act 2020 and the laws under which the registers are kept. You must not: sell, resell, publish or sub-license it; use it to build a database, list or service of your own; offer anyone access to MBIE's systems through the service; make misleading statements about Register Data or about MBIE; or show Register Data on a website that promotes or facilitates hatred, violence, terrorism, discrimination or illegal activity, that is misleading, defamatory or pornographic, or that infringes people's privacy.

(c) **What you export, print or send.** You are responsible for Register Data once it leaves the service through you, for example in an export, a report, a printout or an email you forward. If you show it to someone else (such as a client, your auditor or your adviser), keep the acknowledgement of MBIE as the source, and the date and time, that come with it, and make sure they use it only as this clause allows.

(d) **Errors.** If you think Register Data is wrong, report it to MBIE, which keeps the register. You can also tell us, and we'll pass it on.

(e) **MBIE's rights.** MBIE owns the rights in Register Data and gives us no promise that it is accurate, complete or available. MBIE is not liable to you for any loss arising from Register Data or from it being unavailable. MBIE may enforce this clause 12.4 directly against you, under subpart 1 of Part 2 of the Contract and Commercial Law Act 2017.

(f) **If MBIE changes or ends our access.** MBIE can change, suspend or end our access to Register Data, in some cases straight away. If it does, we may stop showing Register Data and delete what we hold, without notice and without liability to you, and clause 2.3 does not apply. A check we could not do is shown as "Not checked", never as a clear result.

## 13. Warranties, business use and the law

13.1 **What we promise.** We'll provide the service with reasonable care and skill.

13.2 **What we don't promise.** Apart from that, and to the extent the law allows, we give no other warranties or guarantees, express or implied. In particular we don't promise that the service will meet your needs, catch every error or fraud, identify every supplier or customer in financial difficulty, or be uninterrupted.

13.3 **New Zealand: if you acquire the service for a business.** This clause applies if you are in New Zealand and you acquire the service for the purposes of a business. You and we are both in trade, and we agree in writing, as section 43 of the Consumer Guarantees Act 1993 and section 5D of the Fair Trading Act 1986 allow, that: (a) the Consumer Guarantees Act 1993 does not apply to our supply of the service to you; and (b) sections 9, 12A and 13 of the Fair Trading Act 1986 do not apply to our supply of the service to you. We both consider this fair and reasonable: you are a business, you can read these terms and ask us questions before you sign up, the price reflects the terms, and you can try the service for 7 days first. If you do not acquire the service for the purposes of a business, this clause does not apply to you, and nothing in these terms takes away your rights under those Acts.

13.4 **Australia: guarantees that cannot be excluded.** This clause applies only if you are in Australia. Our service comes with guarantees that cannot be excluded under the Australian Consumer Law. For major failures with the service, you are entitled: (a) to cancel your service contract with us; and (b) to a refund for the unused portion, or to compensation for its reduced value. You are also entitled to be compensated for any other reasonably foreseeable loss or damage. If the failure does not amount to a major failure, you are entitled to have problems with the service rectified in a reasonable time and, if this is not done, to cancel your contract and obtain a refund for the unused portion of the contract. Nothing in these terms excludes, restricts or modifies those guarantees or any other right or remedy you have under the Australian Consumer Law that cannot be excluded. Where the law allows us to limit our liability for a failure to comply with a consumer guarantee, we limit it, at our option, to supplying the service again or paying the cost of having the service supplied again. The refund, liability and no-warranty clauses of these terms (7.9, 13.2 and 14) apply to you only to the extent they are consistent with this clause.

## 14. Limits on our liability

14.1 **Cap.** To the extent the law allows, our total liability to you for all claims arising out of or in connection with this agreement, whether in contract, tort (including negligence) or otherwise, is limited to the fees you paid us in the 12 months before the event that gave rise to the claim. Where a firm pays the fees for your organisation, the fees paid for your organisation count.

14.2 **No indirect loss.** To the extent the law allows, we aren't liable for indirect or consequential loss, or for loss of profit, revenue, savings, goodwill or opportunity, or for the cost of replacing or recreating data.

14.3 **Specific exclusions.** In particular, and to the extent the law allows, we aren't liable for: payments made, or not made, on documents that were approved or not approved; fraud or error that a risk indicator didn't flag; information from public registers, including a register being wrong, late or unavailable; decisions made by your people, your rules or your AI agents; or problems caused by Xero, your email systems, or other services we don't control.

14.4 **What the limits don't touch.** Nothing in these terms limits liability that can't be limited by law, or your obligation to pay fees.

14.5 **Time to claim.** Tell us as soon as you find a problem. Any claim against us must be made within 6 months of when you first knew, or ought reasonably to have known, of the facts giving rise to it, unless the law says a longer period applies.

## 15. Misuse of the service

If your misuse of the service, or your breach of clause 6.1, causes us loss, including a claim by a third party, you will compensate us for that loss. This does not apply to loss that we cause.

## 16. Ending the agreement

16.1 **You** can cancel at any time (clause 7.9).

16.2 **We** can end this agreement if you seriously breach it and don't fix it within 14 days of our notice, or immediately if the breach can't be fixed or your use puts the service or others at risk, or if you become insolvent, or if a payment you made to us is charged back, reversed or disputed with your bank or card issuer (a **payment dispute**). A payment dispute is a termination event: we may suspend or end your account straight away without first asking you to fix it.

16.3 **If we stop the service.** If we decide to stop offering WorkApproved, we'll give you at least 60 days' notice and refund fees you've paid for the unused part of the period.

16.4 **What happens next.** Access ends. Clause 8 applies. Clauses that by their nature should survive (including 5, 8.2, 11, 12, 13, 14, 17 and 18) do.

## 17. Changes to these terms

We may change these terms. We'll give at least 30 days' notice by email to your account administrators and by posting the new version. When the new version takes effect we'll ask you to accept it when you next sign in, and we record which version you accepted and when. If you don't accept a change, you can cancel before it takes effect. If you keep using the service after it takes effect, you accept it. We can change terms sooner where the law or a security issue requires it. A change to clause 12.4 that MBIE's own terms for the registers, or a direction from MBIE, requires can also take effect on shorter notice, as soon as MBIE requires it.

## 18. General

18.1 **New Zealand law and courts.** This agreement is governed by New Zealand law. The New Zealand courts have exclusive jurisdiction, for every customer wherever it is located, except that we may seek urgent relief anywhere, and except for rights the law of Australia does not allow to be excluded (for example, proceedings that the Trans-Tasman Proceedings Act 2010 permits in an Australian court).

18.1A **If exclusive New Zealand courts are not enforceable against you.** If a court decides that clause 18.1 cannot be enforced against a customer located in the United States, then for that customer only: (a) any dispute is resolved by binding arbitration before a single arbitrator, conducted in English; (b) each party waives any right to a jury trial; and (c) each party waives any right to bring or take part in a class, collective or representative action, and may bring claims only in its own individual capacity.

18.2 **Talk first.** Before either of us starts proceedings (other than for urgent relief), we must each contact the other in writing and try in good faith to settle the dispute for 20 working days. You contact us at hello@workapproved.app.

18.3 **Notices.** We'll send notices to the email addresses of your account administrators. You'll send notices to hello@workapproved.app. An email notice is treated as received the next business day.

18.4 **Assignment.** You can't transfer your rights without our consent. We may transfer ours to a successor of the business, or to a related company, and we'll tell you.

18.5 **Events beyond control.** Neither of us is liable for delay or failure caused by events beyond our reasonable control (for example outages of internet, cloud or Xero services, natural disaster, or government action), except for payment obligations.

18.6 **Whole agreement.** This is the whole agreement about the service. You haven't relied on any statement that isn't in it. If part of it is unenforceable, the rest stands. Not enforcing a right isn't giving it up.

18.7 **No one else.** Nobody except you and us has rights under this agreement, including any accounting firm that pays for you. The one exception is MBIE, which may enforce clause 12.4 as that clause says.

18.8 **Relationship.** We're independent parties. This isn't a partnership, agency, employment or joint venture.

---

## Schedule 1: Data processing

This Schedule applies where we process personal information on your behalf. It forms part of the agreement.

### 1. Who does what

1.1 For the information about your approvers, suppliers, customers and other people that comes from Xero or that you enter (the "**Approval Data**"), **you** decide why and how it's used and **we** process it on your behalf. If the GDPR or UK GDPR applies, you are the controller and we are the processor. Under the New Zealand Privacy Act 2020 we act as your agent for that information, and under the Australian Privacy Act we handle it only for you.

1.2 For account, billing, security and support information (the "**Account Data**", such as your administrators' names, emails and login activity, billing contacts and payment records), **we** decide why and how it's used, and we're the controller. Our Privacy Policy covers that.

### 2. The processing

| | |
|---|---|
| Subject matter | Providing the WorkApproved approval-workflow service for your Xero organisation. |
| Duration | While you use the service, then as clause 8.2 of the main terms and clause 3.7 of this Schedule say. |
| Nature | Receiving from Xero, storing, displaying, routing, comparing, emailing, recording, and writing back to Xero. Generating and storing certificates. Running risk checks, including looking up suppliers and customers in public business registers for organisations in New Zealand. Backups. |
| Purpose | To run your approval workflows and keep an audit record for you. |
| Types of personal information | Names, email addresses and roles of your approvers, administrators, auditors and viewers; their decisions, comments, timestamps, IP addresses and device details; names, contact details, tax numbers and bank account details of suppliers and customers who appear in your Xero documents; what public business registers record about those suppliers and customers (organisations in New Zealand); the content of documents and attachments (which may include other personal information); the Xero users list (names and emails). |
| People it's about | Your staff, approvers (including those without logins), accounting-firm staff you have given access, and your suppliers, customers and their contacts. |
| Special categories | We don't ask for them. If your attachments contain any, you're responsible for having a basis to load them. |

### 3. What we promise

3.1 **Instructions.** We process Approval Data only on your documented instructions, which are these terms, your settings in the service and your reasonable written requests, unless the law requires otherwise (in which case we'll tell you, unless the law stops us).

3.2 **Confidentiality.** Everyone at WorkApproved who can access Approval Data is bound to keep it confidential.

3.3 **Security.** We take appropriate technical and organisational measures. They include: encryption in transit (HTTPS); encryption at rest by our hosting providers; extra application-level encryption of Xero tokens and two-factor secrets; strict separation of each organisation's data, with automated tests; two-factor authentication required for administrators and for our own staff console; logging of staff actions; logs that remove personal information and secrets; and dependency and vulnerability checks on every change.

3.4 **Sub-processors.** You authorise us to use the sub-processors on our public list. We'll give at least 30 days' notice of a new one by email to your account administrators and by updating the list. If you reasonably object on data-protection grounds in that time, we'll try to resolve it. If we can't, you may cancel the affected service and we'll refund fees for the unused period. We're responsible for our sub-processors and will have written terms with them that give comparable protection.

3.5 **Helping you.** We'll give reasonable help with requests from people to access, correct or delete their information, and with privacy impact assessments and regulator enquiries. If someone contacts us directly about Approval Data, we'll tell them to contact you (unless the law requires us to answer).

3.6 **Breaches.** If we become aware of a breach of security affecting Approval Data, we'll tell your account administrators without undue delay and aim to do so within 72 hours of becoming aware, with the information we have and updates as we learn more. You're responsible for deciding whether you must notify a regulator or the people affected. We'll help you do that.

3.7 **Deletion.** We don't return Approval Data when this agreement ends, and you are responsible for keeping your own copies. We'll delete Approval Data as clause 8 of the terms says, except where the law requires us to keep it. Audit rows are kept for 12 months after an organisation is deleted, can be read only by WorkApproved support, and are then deleted.

3.8 **Information and audits.** We'll give you the information reasonably needed to show we comply with this Schedule, including our security documents and our hosting provider's published assurance reports. If that isn't enough, we'll allow one audit a year on reasonable notice, during business hours, at your cost, under confidentiality, and without access to other customers' data.

### 4. What you promise

4.1 You have a lawful basis to give us the Approval Data, and you've given people any notices the law requires.

4.2 Your instructions comply with the law.

4.3 You'll keep your own login and approver arrangements secure.

### 5. Transfers outside your country

5.1 Our database is in Sydney, Australia (AWS). Files are stored with Cloudflare R2, whose location Cloudflare doesn't guarantee. Approval Data is processed by us in New Zealand and by sub-processors in other countries listed on our sub-processor list (including the United States and Japan for email, and Cloudflare's worldwide network for delivery). You agree to these transfers.

### 6. Liability

Liability under this Schedule is subject to clause 14 of the main terms.

---

## Schedule 2: Plans and retention

| | Standard | Plus |
|---|---|---|
| Users | Unlimited | Unlimited |
| Approval workflows, line routing, email approvers, auto-approval, risk indicators, auditor role, MCP read-only | Included | Included |
| Attachment working copies kept | Up to 18 months from approval (default; you can choose shorter) | Longer than 18 months |
| Audit log kept | 3 years | Longer than 3 years |
| MCP write (approve or reject by an AI agent) | Not included | Included |
| Auditor-grade audit detail (hash-chained log, full snapshots, rights history, anomaly reports, exports) | Not included | Included |

Prices and features are as shown on the pricing page when you subscribe or renew. Partner pricing is set out in the Partner Terms.

**Other retention rules.** Certificates and approval records are kept while your organisation is on WorkApproved. Name, size and SHA-256 fingerprint of a deleted attachment copy are kept. Audit rows of a deleted organisation are kept for 12 months and then deleted. Billing and tax records are kept as the law requires.

---

WorkApproved is a product of [Stone Pritchard Limited](https://stonepritchard.com), [NZBN 9429053953216](https://www.nzbn.govt.nz/mynzbn/nzbndetails/9429053953216/), New Zealand.

Legal: [Terms](https://workapproved.app/terms.md) · [Privacy](https://workapproved.app/privacy.md) · [Partner terms](https://workapproved.app/partner-terms.md) · [Subprocessors](https://workapproved.app/subprocessors.md)

© 2026 Stone Pritchard Limited. Xero is a trademark of Xero Limited. WorkApproved is an independent product and is not endorsed by, or affiliated with, Xero.