Where your data is stored

Your account, client profile and offer records are stored in a Google Cloud database in Toronto (northamerica-northeast2).

Our application servers run on Google Cloud in Toronto and Montreal.

Uploaded files, including ID documents, financing documents and signed offer packages, are stored in Google Cloud Storage in the United States (us-east1).

Sign-in is handled by Google Firebase Authentication, which Google processes in the United States.

E-signatures run on our own installation of Documenso, hosted on Google Cloud in Toronto. Its database backups are stored in Google Cloud's United States multi-region.

AI processing

AI features use Google's Gemini models through Google Cloud Vertex AI. Google's terms for Vertex AI say Google will not use this data to train its models without our permission.

We send these requests to Google's global endpoint, which means Google may process a request in any of its regions, including outside Canada.

Voice conversations with the assistant are processed by Google in the United States (us-central1).

To find and fix errors in the assistant, we send records of its requests and responses to LangSmith, which is hosted in the United States. LangSmith's terms say it does not train on customer data.

We do not send your data to OpenAI or Anthropic.

Other services that handle your data

Email is sent through Brevo, which stores data in the European Union.

Text messages are sent through Twilio, which processes them in the United States.

Product analytics use PostHog, hosted in the United States. We send PostHog an account ID and role, not names or email addresses, and session recordings hide all text and form inputs. PostHog says it may use anonymized customer data to train its own models unless the customer opts out.

Encryption and access

Google Cloud encrypts the data we store with it at rest. Data travels between your browser and our servers over HTTPS.

Database security rules limit each record to the accounts and roles allowed to see it.

When our staff open an account to give support, each session is recorded in an admin log.

Retention

We keep uploaded files until they are deleted; we do not yet delete them automatically. The database keeps recovery copies for 7 days.

Questions and requests

To ask what we hold about you, or to have it corrected or deleted, email support@directoffers.ca.