Subprocessors
Last updated: July 2026 (Beta)
Beta. DociCA is in invite-only beta. These terms apply to beta use. DociCA is document-automation software, not a law firm, and does not provide legal advice. See our Beta Disclaimer.
DociCA uses the providers below to operate the beta. We share only the data each needs, under contract. Our AI review path is Canada-only and self-hosted — your document text is never sent to a third-party AI provider. Some operational processors (email, analytics) handle limited, non-document data; residency work for those is ongoing, so we label each with its region rather than making a blanket Canada-only claim across every vendor.
Active during beta
| Provider | Purpose | Data class | Region | Transfer basis |
|---|---|---|---|---|
| Supabase / Postgres (self-hosted)AI path | Application database, auth, file storage | Account data, document content, AI reviews | Canada — Québec (OVH BHS) | Processed and stored in Canada — no cross-border transfer |
| Self-hosted AI review model (our own infrastructure)AI path | AI-assisted document review, OCR, embeddings | Document text (live processing only; not persisted by the model) | Canada — Québec (OVH BHS), self-hosted | Self-hosted in Canada — no egress to any third party |
| Resend | Transactional and notification email | Email address + minimal message metadata — no document content | United States⚠ verifying | Law 25 s.17 baseline PIA complete — minimal PI (email only), contractual protections |
| Analytics (self-hosted Umami) | Privacy-friendly, cookie-less usage analytics | Aggregate page events — no document content, no account identifiers | Canada — self-hosted⚠ verifying | Self-hosted in Canada |
Not active during beta
Listed for completeness. Each requires a completed cross-border transfer assessment (PIA) before it is switched on, so it processes no data today.
| Provider | Purpose | Data class | Region | Transfer basis |
|---|---|---|---|---|
| Stripe | Payments / billing | Billing and payment data | United States / global | Not active during beta — cross-border transfer PIA required before activation (T4.4) |
| E-signature (e.g. DocuSign) | Document e-signature (SignVa roadmap) | Signer identity + signed document | United States / global | Not active during beta — cross-border transfer PIA required before activation (T4.4) |
Where we operate vs. what we cover
What we cover (the law)
DociCA’s templates cover Alberta and Ontario common law. Québec civil law is out of scope — being hosted in Québec does not mean DociCA drafts Québec-law documents.
How your data is governed
Because your data is hosted in Québec, it is governed to the Québec Law 25 high-watermark— Canada’s strictest provincial privacy standard — regardless of your matter’s province. You get that protection whether your document is an Alberta or Ontario matter.
In short: Québec is our data region, not a supported drafting jurisdiction. Substantive coverage is AB/ON; the data-governance layer operates to the Québec standard for everyone.
Baseline privacy assessments for the active processors are documented internally (see our AI & data-retention and Privacy Policy pages). Questions? support@docica.ca.