Your email data stays in Canada
Not a US provider's Canadian region. The hardware, the database and the backups are all in Canada, with a provider that is not under US control.
🇨🇦 HOSTED IN CANADAWhere your data physically lives
The production server is in Canada, with a provider that is neither American nor under American control. Nightly backups are stored in Canada too. Nothing passes through a US cloud service, in operation or in backup.
No US subprocessor touches message content. Site analytics are a self-hosted, cookieless Matomo, not Google Analytics.
Why "a Canadian region" is not the same thing
The US CLOUD Act of 2018 lets American authorities compel data from a provider under US control, wherever the servers happen to be. A US provider's Toronto region is therefore reachable in principle in exactly the way its Virginia region is.
That is a point of law, not an accusation — we are not claiming any provider has handed anything over. But if your requirement is "outside the reach of US law", the country the data centre is in does not settle it. The ownership of the company does.
Encrypted at rest — and exactly how far that goes
The PostgreSQL data directory lives on a LUKS2-encrypted volume, separate from the boot disk.
The honest scope: this protects against a stolen or decommissioned disk and against a leaked snapshot. It does not protect against a full compromise of the running server, because the unlock key has to be readable at boot. That is the precise wording our data-processing annex carries, and we would rather put it on the marketing page than let you infer something larger.
Backups the server itself cannot read
Each night the database is streamed straight into public-key encryption (age) — no plaintext ever touches disk — and uploaded within Canada. The server holds only the public key.
Which means a compromised machine cannot decrypt its own backups. The private key stays offline with the operator, and a monthly restore test proves the backups actually restore rather than merely existing.
Compliance
CASL for consent and unsubscribe — every message carries an opt-out, and one-click unsubscribe (RFC 8058) is supported. GDPR and Québec's Law 25 for erasure: a deletion request irreversibly anonymises the account rather than flagging it.
The whole interface, the service emails, and the pages your recipients see exist in French and English. Public pages negotiate language from your recipient's browser, not from your account setting.
Procurement questions?
We answer sourcing questions in writing — subprocessors, data location, retention, encryption. Ask for whatever your review needs.
Create an account