Privacy policy Sub-processors
The third parties we use to process your data.
PIPEDA holds us accountable for personal information no matter who processes it. This page lists every third-party sub-processor we use, what data they touch, and where they operate. We update this page before a new sub-processor ever touches customer data.
| Provider | Category | Purpose | Data accessed | Region |
|---|---|---|---|---|
Anthropic Anthropic Enterprise DPA on file | AI inference | Powers the Maya conversational AI (Claude model API) | Conversation text turn-by-turn. No retention beyond request lifetime (inference-only contract). Never used to train models. | United States (sent from Canadian regions) |
Deepgram Deepgram DPA + SOC 2 Type II | Transcription | Converts voice-call audio to text for processing by Maya | Raw audio bytes during the call, transcription text returned. Per-call basis; no persistence beyond processing. | United States + Canada region option |
Twilio Twilio Master Services Agreement + Data Protection Addendum | Telephony | Inbound/outbound voice calls + SMS + WhatsApp messaging delivery | Phone numbers, call/message content, call recordings. | United States (with EU/CA regional routing available) |
Resend Resend DPA on file | Transactional email delivery (welcome emails, transcript shares, advisor handoffs) | Recipient email + email body content during the send window. | United States | |
Vercel Vercel Enterprise DPA + SOC 2 Type II | Hosting | Web application hosting + edge functions | All inbound HTTPS traffic + logs. | Canada (ca-central-1) for the Mortgage Squad Advisors deployment |
Amazon Web Services AWS Customer Agreement + Data Processing Addendum | Database | Relational + object storage (audio recordings, document attachments) | All persisted customer data (conversations, memory, recordings, documents). | Canada (ca-central-1) |
How we update this page
When we engage a new sub-processor, we update this page and ourprivacy policybefore any production data is shared. Enterprise customers receive 30-day advance notice of material sub-processor changes via the email on file.
When a sub-processor is removed, we keep them listed under a “former” section for 12 months so the audit trail is preserved.
Questions about a specific sub-processor or its data protection terms? Email info@mortgagesquad.ca.