Where your data lives
Your documents are stored and processed in Canada. The database, the file storage and the application servers all run in the Montreal region (Supabase on AWS ca-central-1, Vercel yul1). Everything is encrypted in transit (TLS) and at rest. This includes:
- Original uploaded PDFs
- Pre-flattened working copies
- Final signed PDFs and certificates of completion
- Recipient identification data and signature images
- Audit trail entries and webhook delivery records
What leaves Canada
Three operational subprocessors sit outside the country, and we would rather name the gap than imply there isn’t one:
- Email delivery. Transactional email runs through a US provider. Invitations and reminders carry only an address and a one-time link, but the completion email attaches the signed PDFs and the certificate, so a finished document does pass through that provider on its way to the inbox.
- SMS one-time codes. A US provider delivers the code. It receives a phone number and a six-digit code, never document content.
- Payments. Card processing and invoices are handled by Stripe. We never see or store card numbers.
Nothing else copies envelope content out of the Canadian region. The current subprocessor list is available on request from info@vg-realestate.ca.
Retention
For many financial and commercial agreements, the common retention standard is seven years. We honour that as the default. After year seven, we notify you and give three options: extend retention, export the complete archive (signed PDFs + audit logs as a downloadable ZIP), or securely purge.
Pro and Enterprise customers can request custom retention windows shorter or longer than the default, subject to applicable law.
Your rights
As a Canadian company, we are subject to PIPEDA. You can request access to, correction of, or deletion of your personal information at any time. Email info@vg-realestate.ca with the request and we’ll respond within 30 days.