Axia Cooperative

Axia FinOps Privacy Policy

Effective 5 August 2026

Axia FinOps is an internal application. It is operated by Axia Cooperative for its own staff and is not offered to, sold to, or made available to the public, to member agencies, or to suppliers. There is no public sign-up. Accounts are created only for named Axia personnel.

This policy explains what the application handles, how it is protected, and who processes data on Axia's behalf. It applies to the application only. It does not govern Axia Cooperative's cooperative purchasing agreements, its participating agencies, or its website.

What the application does

Axia FinOps is Axia's book of operational record for cooperative contract activity. It ingests supplier sales reports, calculates administrative fees and rebates, produces invoices, and mirrors the resulting entries into Axia's accounting system.

What information it holds

The records are commercial, not consumer. They concern organizations and the people who represent them in a business capacity.

• Organization records for suppliers, lead agencies, and participating public agencies: legal name, addresses, and contract identifiers.
• Business contacts at those organizations: name, work email address, work phone number, and role. Collected so invoices, rebate statements, and quarterly reports reach the correct person.
• Transaction records reported by suppliers: purchase amounts, dates, the purchasing agency, and the contract used.
• Financial records derived from the above: fee and rebate calculations, invoices, payments, and the accounting entries mirroring them.
• Staff account records for Axia personnel: name, work email, and role.

The application does not handle consumer data, payment card numbers, bank account numbers, government identifiers, health information, or any special category of personal data.

QuickBooks Online

Axia FinOps connects to a single QuickBooks Online company, owned and controlled by Axia Cooperative. It never connects to a customer's, supplier's, or third party's QuickBooks company, and it is not distributed to anyone who could connect it to theirs.

The connection is authorized by an Axia administrator through Intuit's OAuth flow. Within Axia's own company file, the application reads and writes invoices, customers, vendors, items, accounts, bills, and payments, for the sole purpose of keeping Axia's accounting records consistent with the fee and rebate figures the application calculates.

Access tokens issued by Intuit are encrypted before storage and are never written to logs or exports. An administrator can disconnect the integration at any time from within the application or from QuickBooks, which revokes the tokens and stops all further access.

How information is protected

• The application is not reachable from the public internet. All requests pass through an identity-aware proxy before reaching it, and are then authenticated again by the application against a named staff account.
• All traffic is encrypted in transit. Data is encrypted at rest by the hosting provider.
• Third-party credentials, including Intuit access and refresh tokens, are encrypted at the application layer with a key held only in the server environment.
• Financial records are append-only. Corrections are recorded as new entries rather than by altering or deleting history, and every change is written to a tamper-evident audit log.

Backups and retention

Complete encrypted backups are written to independent offsite storage under a compliance-mode retention lock, which prevents any party, including Axia, from altering or deleting a backup before its retention period expires.

Financial records are retained for seven years, consistent with the record retention Axia's public-sector contracts and tax obligations require. Records are not deleted on request where retention is required by law or contract.

Service providers

Axia uses the following processors. Each receives only what its function requires, and none is permitted to use Axia's data for its own purposes.

Provider	Function
Intuit	QuickBooks Online accounting integration
Render	Application and database hosting, United States
Cloudflare	DNS and identity-aware access control
Backblaze	Encrypted offsite backup storage
Microsoft	Staff identity, and the mailbox that receives supplier reports
HubSpot	Organization and contact records

What Axia does not do

• Axia does not sell, rent, or license this information to anyone.
• Axia does not use it for advertising, and runs no advertising or third-party analytics trackers in the application.
• Axia does not disclose it except to the processors above, to its professional advisers under a duty of confidentiality, or where required by law.

Your choices

If you are a business contact at a supplier or agency and want to know what the application holds about you, or want your contact details corrected or removed from future correspondence, write to the address below and Axia will respond within thirty days. Transaction and financial records that name your organization are business records subject to the retention above and cannot be deleted on request.

Changes

Material changes will be reflected here with a revised effective date.

Contact

Axia Cooperative
Nashville, Tennessee, United States
publicsector@axiacoop.org