Sub-Processors
Last Updated: May 15, 2026
Canada Compliance AI engages the following third-party sub-processors to provide the Services. In accordance with PIPEDA and Quebec Law 25, we maintain this current list of all entities that process customer data on our behalf. We will notify customers 30 days in advance of adding new sub-processors or making material changes to existing ones.
Current Sub-Processors
Supabase Inc.
WebsitePurpose
Database hosting, authentication, file storage
Data Location
Canada (Montreal region)
Certifications
SOC 2 Type II, ISO 27001
Added
January 2026
Stripe Inc.
WebsitePurpose
Payment processing, subscription billing
Data Location
Canada-compliant processing
Certifications
PCI DSS Level 1, SOC 2 Type II, ISO 27001
Added
January 2026
Vercel Inc.
WebsitePurpose
Web hosting, CDN, frontend infrastructure
Data Location
Canada/US regions
Certifications
SOC 2 Type II
Added
January 2026
Google LLC
WebsitePurpose
Analytics (optional, consent-based)
Data Location
US with Standard Contractual Clauses
Certifications
ISO 27001, SOC 2/3
Added
January 2026
Note: Only used if user explicitly consents via cookie banner
Resend Inc.
WebsitePurpose
Transactional email delivery
Data Location
US
Certifications
SOC 2 Type II
Added
April 2026
Anthropic PBC
WebsitePurpose
AI-assisted compliance features (Claude API) — processes the text you submit to an AI feature
Data Location
US
Certifications
SOC 2 Type II, ISO 27001
Added
September 2026
Note: Only used when you use an AI feature. Anthropic does not train on API inputs or outputs.
Sub-Processor Change Notification
We will notify all active customers via email at least 30 days before:
- Adding a new sub-processor
- Materially changing an existing sub-processor's scope of data processing
- Changing the data residency location for any sub-processor
Customers may object to a new or changed sub-processor within the 30-day notice period by contacting contact@canadacomplianceai.ca. If we cannot accommodate the objection, Customer may terminate the agreement without penalty.
Data Processing Agreements
Canada Compliance AI has executed Data Processing Agreements (DPAs) or Data Processing Addendums with all sub-processors listed above, ensuring they meet the same data protection obligations we commit to in ourDPA with customers.
For questions about sub-processor agreements or to request a copy of our DPA, contact contact@canadacomplianceai.ca.