Where your data lives
All operational data sits in Supabase’s ca-central-1 region, which is hosted on AWS infrastructure in Montreal, Quebec. This includes:
- Original uploaded PDFs
- Pre-flattened working copies
- Final signed PDFs and certificates of completion
- Recipient identification data and signature images
- Audit trail entries and webhook delivery records
Backups are stored within the same region and never replicated cross-border.
What about subprocessors?
A small set of operational subprocessors handle email, SMS, and analytics. None of them store envelope content or signer-identifiable data — they receive only the metadata necessary to do their job (e.g. an email address and a one-time link). The current subprocessor list is published in our DPA, available on request from legal@vg-sign.com.
Retention
PIPEDA requires that we retain signed agreements for a defined period — for real estate and similar financial agreements, the standard is seven years. We honour that as the default. After year seven, we notify you and give three options: extend retention, export the complete archive (signed PDFs + audit logs as a downloadable ZIP), or securely purge.
Pro and Enterprise customers can configure custom retention windows shorter or longer than the default, subject to applicable law.
Customer rights
Under PIPEDA you can request access to, correction of, or deletion of your personal information at any time. Email legal@vg-sign.comwith the request and we’ll respond within 30 days.
Cross-border transfers
We do not transfer envelope content out of Canada. The application infrastructure (Vercel edge) may serve static assets from globally distributed nodes for performance, but no customer-identifiable data flows through those nodes.