1. The list
These are the companies that process client data on our behalf. It is a short list on purpose: every name on it is a company a firm has to take on trust because we asked them to.
- Supabase
- Hosts the database holding each firm's records, and the storage holding uploaded documents. Data is in Canada (Montreal). Supabase Inc. is incorporated in the United States.
- Fly.io
- Runs the application servers — the machines that decrypt and render your data. Pinned to the Toronto region; data is processed in Canada. Fly.io Inc. is incorporated in the United States.
- Cloudflare
- Provides DNS and sits in front of the application, terminating TLS and filtering malicious traffic. Your data transits Cloudflare but is not stored there. Cloudflare Inc. is incorporated in the United States.
- Stripe
- Processes subscription payments. Receives your firm's billing details and never receives client data. Stripe Payments Canada Ltd.
2. What is not on the list, and why
Some things that look like subprocessors are not, and the reasons matter more than the omissions:
- Your email provider
- Client email is sent through your firm's own mailbox, using credentials you provide. Your provider is your supplier, not ours, and we never send your clients mail from an address of ours.
- Electronic signatures
- The signing service runs on our own infrastructure rather than a third party's. Signed documents do not leave systems covered by this list.
- Your tax software
- T1 Manager does not connect to it, does not read from it, and does not file returns. Nothing passes between them except what your staff copy by hand.
3. Being straight about two of our own systems
Two parts of our operation still depend on Google, and we would rather say so here than have a firm discover it:
- Encrypted backup bundles are currently stored on Google Drive. They are encrypted before they leave our systems, so Google holds ciphertext it has no key for — but the storage is Google's and is not guaranteed to be in Canada. This is being moved to encrypted storage in Canada, and until it is, it is disclosed.
- Our own platform email — password resets and signup confirmations to your firm's staff — currently leaves through a Google mailbox. It never carries client data. It is being moved to our own domain.
4. Incorporation is not residency
Three of the four companies above are incorporated in the United States, and every one of them stores or processes your data in Canada. Those are different facts and only the second is about your clients' information.
We state both because a firm evaluating us should be able to reach its own conclusion rather than ours. A US-incorporated supplier may be subject to legal process in its own country; the practical protection is that data is in Canada, that documents and Social Insurance Numbers are encrypted, and that we will tell you before complying with a demand unless we are prohibited from telling you.
5. Changes
We give at least 30 days' notice by email to your account owner before adding or replacing anyone on this list. Clause 6 of the Data Processing Agreement sets out what you can do if you object.
This page carries an effective date and a version. If it has changed since your firm last accepted it, you will be asked to review it when you next sign in.