Where your data lives
VG·Sign runs on Supabase, hosted on Amazon Web Services (AWS). All operational data is encrypted in transit (TLS) and at rest. This includes:
- Original uploaded PDFs
- Pre-flattened working copies
- Final signed PDFs and certificates of completion
- Recipient identification data and signature images
- Audit trail entries and webhook delivery records
What about subprocessors?
A small set of operational subprocessors handle email, SMS, and analytics. None of them store envelope content or signer-identifiable data — they receive only the metadata necessary to do their job (e.g. an email address and a one-time link). The current subprocessor list is available on request from info@vg-realestate.ca.
Retention
For many financial and commercial agreements, the common retention standard is seven years. We honour that as the default. After year seven, we notify you and give three options: extend retention, export the complete archive (signed PDFs + audit logs as a downloadable ZIP), or securely purge.
Pro and Enterprise customers can request custom retention windows shorter or longer than the default, subject to applicable law.
Your rights
As a Canadian company, we are subject to PIPEDA. You can request access to, correction of, or deletion of your personal information at any time. Email info@vg-realestate.ca with the request and we’ll respond within 30 days.