Regulatory Boundary & Product Operating Standard

1. Purpose

This document establishes the regulatory and operational boundaries within which QanaFinance must be designed, developed and operated.

QanaFinance is a software-as-a-service accounting and financial management platform. It is not intended to operate as a bank, payment service provider, money services business, lender, investment service, financial institution, payroll remitter, money transmitter or custodian of customer funds.

All product development, integrations, workflows and future features must preserve this distinction unless QanaFinance Inc. expressly approves a change following appropriate legal and regulatory review.

2. Core Product Principle

QanaFinance records, organizes, reconciles, calculates and reports financial activity. QanaFinance does not hold, custody, lend, invest or independently transmit customer funds.

Third-party financial service providers may be integrated with QanaFinance to provide services outside this boundary. Examples include:

• Stripe or another approved payment processor for payment processing;
• Plaid or another approved financial-data provider for bank connectivity;
• banks and financial institutions for deposit accounts and banking services;
• third-party payroll providers for payroll processing and remittances;
• third-party lenders for lending or financing;
• other regulated or appropriately authorized providers for financial services.

QanaFinance may display information received from these services and record resulting transactions within the customer's accounting records.

3. Accounting Software Functions

QanaFinance may provide software functionality including:

• general ledger accounting;
• chart of accounts;
• accounts receivable;
• accounts payable;
• customer and vendor records;
• estimates and quotes;
• invoicing;
• bills and expenses;
• bank transaction imports;
• bank feeds;
• transaction categorization;
• transaction matching;
• bank and credit-card reconciliation;
• journal entries;
• sales-tax calculations;
• GST/HST tracking;
• financial statements;
• management reporting;
• budgeting;
• project and job costing;
• document storage;
• receipt and invoice attachment;
• audit trails;
• recurring transactions;
• payment-status tracking;
• accounting automation;
• financial-data import and export;
• accountant/bookkeeper access;
• user permissions;
• dashboards and business analytics.

These functions constitute software functionality and do not authorize QanaFinance to perform regulated financial activities outside the boundaries established by this document.

4. Customer Funds — Absolute Boundary

QanaFinance shall not take possession, custody or control of customer funds. QanaFinance shall not maintain:

• customer deposit accounts;
• stored-value balances;
• customer wallets;
• pooled customer accounts;
• settlement accounts holding customer funds;
• Qana-controlled clearing accounts; or
• customer funds awaiting withdrawal or distribution.

Customer money must not be deposited into a QanaFinance or QanaFinance Inc. bank account as part of a customer's business transaction. QanaFinance subscription fees paid to QanaFinance Inc. are excluded from this restriction because those payments are payments for QanaFinance's own services.

5. Payment Processing

QanaFinance may integrate with Stripe or another approved third-party payment provider. The third-party payment provider must remain responsible for the processing, authorization, settlement and transfer of payment funds.

Where a QanaFinance customer enables invoice payments:

1. the Qana customer connects or establishes its own account with the payment provider;
2. the customer's payer may initiate payment through the integrated payment functionality;
3. the payment provider processes the transaction;
4. funds are settled according to the payment provider's arrangements with the Qana customer;
5. QanaFinance receives transaction or payment-status information;
6. QanaFinance records the resulting accounting transaction.

QanaFinance must not receive the customer's invoice proceeds and subsequently forward those proceeds to the customer.

QanaFinance may record statuses such as:

• Pending;
• Authorized;
• Paid;
• Failed;
• Refunded;
• Disputed; and
• Partially Paid.

Such statuses are accounting and informational records and do not indicate that QanaFinance controls the underlying funds.

6. Stripe Integration

Where Stripe is used, each QanaFinance business customer must connect to Stripe through an integration structure approved for the intended use. QanaFinance must not represent itself as the merchant, seller or recipient of its customer's invoice proceeds unless QanaFinance Inc. itself is selling the relevant goods or services.

Stripe credentials, API secrets, signing secrets and access tokens must be securely managed and must never be exposed to unauthorized users or client-side applications where such exposure would create a security risk.

Webhook events must be authenticated and verified before accounting records are automatically updated. Duplicate webhook events must not create duplicate accounting transactions.

Payment records must retain appropriate references connecting:

• the invoice;
• customer;
• payment-provider transaction;
• payment amount;
• fees where available;
• refund where applicable;
• settlement information where available; and
• resulting accounting entries.

7. Bank Connections and Plaid

QanaFinance may integrate with Plaid or another approved financial-data connectivity provider.

QanaFinance must not intentionally collect or permanently store a user's online-banking password, PIN, security answer or equivalent banking authentication credential. Bank authentication should occur through the financial institution, Plaid or another authorized connectivity mechanism wherever available.

QanaFinance may receive authorized financial information including, where available:

• institution;
• account name;
• account type;
• masked account identifier;
• balance information;
• transaction dates;
• transaction descriptions;
• transaction amounts;
• pending transactions;
• posted transactions; and
• other information authorized by the user and supported by the provider.

Access to bank information must be limited to the information reasonably required to provide QanaFinance functionality.

8. Canadian Consumer-Driven Banking

Canada's consumer-driven banking framework is evolving. QanaFinance's bank-data architecture must therefore be modular and capable of adapting to regulatory, accreditation, consent, security and technical requirements introduced under Canada's Consumer-Driven Banking Act and related regulations.

The company must review applicable requirements before QanaFinance directly participates in regulated consumer-driven banking. Where an accredited or authorized third-party provider can lawfully perform bank connectivity or data-sharing functions on QanaFinance's behalf, QanaFinance should preferentially use that infrastructure rather than unnecessarily assuming regulated banking-data functions itself.

No developer may implement screen scraping, collection of banking passwords or a replacement banking-connectivity mechanism without express approval from QanaFinance Inc.

9. No Lending or Financing

QanaFinance does not provide loans, credit or financing. QanaFinance shall not:

• lend customer funds;
• advance funds against invoices;
• purchase receivables;
• provide factoring;
• issue credit;
• determine creditworthiness on behalf of a lender;
• guarantee loans; or
• collect lending interest for its own account.

Third-party financing providers may eventually be integrated with QanaFinance provided the third party remains responsible for the financing product and all applicable regulatory requirements.

10. No Investment or Securities Services

QanaFinance does not provide:

• investment management;
• securities trading;
• investment recommendations;
• portfolio management;
• cryptocurrency trading;
• foreign-exchange dealing; or
• custody of investment assets.

Financial dashboards and analytics are business-management and accounting tools and must not be represented as personalized investment advice.

11. No Professional Accounting, Tax or Legal Advice

QanaFinance provides software tools. Use of QanaFinance does not create an accountant-client, lawyer-client, fiduciary or professional advisory relationship between QanaFinance Inc. and the user.

Calculations, categorizations, suggested entries, reports, AI-generated suggestions and automated workflows are tools intended to assist users. Users remain responsible for:

• the accuracy of their accounting records;
• determining appropriate accounting treatment;
• tax filings;
• tax remittances;
• regulatory filings;
• financial decisions; and
• obtaining professional advice where appropriate.

12. Accounting Data Integrity

QanaFinance must maintain appropriate integrity of accounting records. Posted financial transactions must not be silently altered or deleted in a manner that destroys the historical accounting record.

Where appropriate, QanaFinance must use:

• transaction reversals;
• adjusting entries;
• void transactions;
• documented corrections;
• reconciliation history;
• period locks; and
• audit trails.

Material changes to accounting records should record:

• user responsible;
• date and time;
• original value;
• revised value; and
• relevant transaction or record.

System administrators must not be provided with functionality that unnecessarily circumvents these controls.

13. Reconciliation

Bank reconciliation is an accounting-control function. QanaFinance must preserve:

• statement opening balance;
• statement closing balance;
• statement period;
• cleared transactions;
• outstanding transactions;
• reconciliation adjustments;
• difference remaining;
• reconciliation completion date; and
• user completing the reconciliation.

Completed reconciliations should be locked or otherwise protected against silent alteration. Subsequent changes affecting a reconciled transaction must generate an appropriate warning, audit record or reconciliation exception.

14. Privacy and Financial Data

QanaFinance will process confidential business and personal information. The system must be designed according to principles of:

• data minimization;
• purpose limitation;
• appropriate consent;
• access control;
• secure storage;
• secure transmission;
• retention limitation;
• accountable deletion;
• transparency; and
• appropriate breach response.

QanaFinance shall collect only information reasonably required to provide its services or satisfy legitimate operational and legal requirements.

15. Security

At minimum, QanaFinance must support appropriate safeguards including:

• encrypted transmission;
• secure storage;
• secure credential handling;
• role-based access;
• multi-factor authentication where appropriate;
• session security;
• audit logging;
• backup and recovery;
• controlled administrative access;
• webhook verification;
• API authentication;
• token protection;
• rate limiting where appropriate;
• vulnerability management; and
• incident-response procedures.

Passwords must never be stored in plaintext. Sensitive API secrets and financial-access tokens must not be exposed through normal user interfaces or logs.

16. User and Role Segregation

QanaFinance must support permission-based access. Examples may include:

• Business Owner / Administrator;
• Accountant;
• Bookkeeper;
• Accounts Receivable;
• Accounts Payable;
• Manager;
• Employee;
• External Accountant; and
• Read Only.

Access to sensitive financial information must not automatically be granted simply because a user has access to another part of the business. Permissions should follow the principle of least privilege.

17. Data Ownership

As between QanaFinance and the customer, customers retain ownership of the business information and accounting data they submit to QanaFinance, subject to the Terms of Service and applicable law. QanaFinance receives the limited rights necessary to host, process, secure, transmit, back up and otherwise use customer data to provide and improve the service as permitted by the Terms of Service and Privacy Policy.

18. Data Portability

Customers must have reasonable means to export important accounting information. Export functionality should be designed to reduce unreasonable vendor lock-in and facilitate:

• accountant review;
• record retention;
• tax review;
• migration; and
• business continuity.

Available export formats may depend upon the relevant data type.

19. Third-Party Services

Third-party services must remain legally and operationally distinct from QanaFinance. QanaFinance may integrate with providers such as Stripe and Plaid but does not guarantee their:

• availability;
• accuracy;
• uptime;
• continued compatibility;
• transaction approval;
• bank coverage; or
• continued provision of services.

The system must be capable of identifying third-party service failures separately from QanaFinance accounting errors wherever reasonably possible.

20. Artificial Intelligence and Automation

AI and automation may assist with:

• transaction categorization;
• transaction matching;
• reconciliation suggestions;
• anomaly detection;
• document extraction;
• bookkeeping suggestions;
• reporting;
• descriptions; and
• workflow automation.

AI-generated accounting suggestions must not be represented as guaranteed accounting, legal, tax or financial advice. Where a decision materially affects accounting records, QanaFinance should provide appropriate user review, confirmation or auditability based upon the risk of the action.

21. Prohibited Future Features Without Regulatory Review

The following features must not be introduced merely because they are technically possible:

• holding customer money;
• transmitting funds independently;
• customer wallets;
• stored-value accounts;
• Qana-issued cards;
• lending;
• invoice financing;
• factoring;
• foreign-exchange services;
• cryptocurrency custody or exchange;
• investment services;
• independent payroll fund remittance;
• cheque clearing;
• Qana-controlled settlement accounts; or
• direct participation in regulated financial-data sharing where accreditation or authorization may be required.

Any proposal involving these activities requires regulatory review before development or release.

22. Development Rule

When there is uncertainty whether a feature causes QanaFinance to move from providing accounting software into providing a regulated financial service:

DO NOT IMPLEMENT THE FEATURE UNTIL THE REGULATORY POSITION HAS BEEN REVIEWED.

Technical convenience is not authorization to expand QanaFinance's regulatory role.

23. Product Positioning

QanaFinance should be described as business accounting and financial-management software. It should not describe itself as:

• a bank;
• financial institution;
• money transmitter;
• payment processor;
• lender;
• investment manager; or
• custodian of customer funds.

Third-party payment and bank-data services should be clearly identified as third-party services where appropriate.

24. Governing Principle

QanaFinance is intended to make business accounting simpler without unnecessarily assuming the regulatory responsibilities of the financial institutions and payment providers whose infrastructure it integrates. Where a regulated, insured or specialized third party exists to perform a financial function, QanaFinance's preferred role is to integrate with that provider, receive the resulting authorized information and accurately account for the transaction.

QanaFinance is the accounting system — not the bank.