ValdraBY CANUCKT Français All legal documents →

Sub-processor List

Valdra — Canuckt Synergy Solutions Inc. Version 1.1 · Effective 29 August 2026

These are the third parties that may process customer personal information on our behalf. We give 30 days' notice before adding or replacing any of them, as set out in section 5 of our Data Processing Agreement.

What changed in version 1.1

Transactional email moved from Brevo to Postmark (AC PM LLC). Sign-in links, notifications, contract delivery and privacy-request correspondence are now sent by Postmark. Brevo remains in use only for our own marketing email and no longer carries transactional messages or customer compliance records.

This change was made in production before this list was updated, which is not the sequence section 5 of our Data Processing Agreement describes. We are telling you plainly rather than quietly reissuing the list. Customers under a DPA are being notified directly.

Core infrastructure

Sub-processor	Function	Data processed	Location
OVH SAS	Production hosting, compute, storage, backups	All customer data at rest	🇨🇦 Beauharnois, Québec, Canada
Cloudflare, Inc.	DNS, TLS termination, DDoS protection, CDN	Traffic metadata; no customer records stored	🇺🇸 US-headquartered; edge routing global. Requests to the application terminate on Canadian infrastructure

Application services

Sub-processor	Function	Data processed	Location
Anthropic PBC	AI generation for assessment recommendations, policy drafting and the in-product assistant	Only the content submitted for that specific request	🇺🇸 United States
AC PM LLC (Postmark, an ActiveCampaign company)	Transactional email — sign-in links, notifications, contract delivery, privacy-request correspondence	Recipient email address, message content	🇺🇸 United States
Brevo (Sendinblue SAS)	Marketing email (commercial electronic messages) to our own contacts. Does not carry transactional email or customer compliance records.	Recipient email address, message content	🇪🇺 European Union
Stripe Payments Canada, Ltd.	Subscription billing and payment processing	Billing contact and payment details. Card details are handled by Stripe and never reach our systems	🇨🇦 Canada / 🇺🇸 US
Functional Software, Inc. (Sentry)	Application error monitoring	Technical diagnostics. Personal information is scrubbed before transmission	🇺🇸 United States

About the AI processing

This is the question customers ask most, so we answer it directly.

Your data is not used to train models. Anthropic does not train on data submitted through its commercial API.
Only what is needed is sent. We send the specific content required for the request you made — not your whole workspace.
Personal information is redacted before it leaves. AI requests pass through our own Shielk redaction engine first. This is enforced by an automated pre-deployment check that blocks any release introducing an unredacted AI call.
You can see what happened. AI activity is recorded in your audit log.
It can be limited. Organisations that prefer to restrict AI features can ask us to disable them on their account.

About cross-border processing

Your records live in Canada. The services above that operate outside Canada process data in transit — an email being delivered, an AI request being answered, an error report being filed — rather than acting as a store of your compliance records.

Where a sub-processor is outside Canada, personal information is protected by contractual commitments with that provider, and we assess each one before engagement, as required by PIPEDA Principle 4.1.3.

If your organisation requires that no personal information be processed outside Canada, tell us. AI features and outbound email are the two areas affected, and both can be restricted on your account.

Internal — not third parties

Shielk is our own PII detection and redaction engine, operated by Canuckt Synergy Solutions Inc. on the same Canadian infrastructure. It is not a third party, and no customer data is transferred outside our control when it is used.

Changes to this list

Material changes are notified to account administrators by email at least 30 days in advance. The current version is always available from us on request, and is provided with our Data Processing Agreement.

Questions: [email protected]