Trust
Subprocessors and where data lives
The third parties that process data on our instructions, what each receives, and where it is stored. Written to be answerable in a security questionnaire rather than read for pleasure.
Data residency
Your reports and tokens are stored in Canada. The application, queue and database run on servers in Beauharnois, Québec, operated by Xosmic Inc. — an Ontario company subject to Canadian federal privacy law.
Payment and email providers are US-based, and the table below says exactly what reaches them. Your Salesforce metadata is not among it: the raw metadata a scan reads is discarded once the report is built, and never leaves our own infrastructure.
Subprocessors
| Provider | Purpose | What it receives | Where |
|---|---|---|---|
| OVHcloud | Hosting — the application, the queue and the database | Everything stored: accounts, reports, encrypted Salesforce tokens | Beauharnois, Québec, Canada |
| Stripe | Payments and subscription billing | Billing email and payment details, sent to Stripe directly by your browser — card numbers never reach our servers | United States, with EU and global processing |
| Resend | Transactional email — sign-in links and report delivery | Recipient address, message content, and an attached report where you asked for one | United States |
What we do not use
No advertising networks, no session recording, no third-party tracking, and no tracking cookies — which is why this site has no consent banner to dismiss. The only cookie is the one that keeps you signed in.
We do not train models on your data, and we do not sell or share it with anyone outside this table.
Changes and questions
If we add a subprocessor, it appears here. For a data processing agreement, a completed security questionnaire, or anything your procurement team needs, get in touch — see also what we read from your org and privacy.