Subprocessors
An earlier version, kept at its own address.
Effective 12 October 2026 · version subprocessors-2026-10-12 · replaced by a later version
This is an earlier version, kept so that anybody who agreed to it can still read it. It is not the wording a new customer agrees to today: that is the current Subprocessors. Every version.
Last updated 12 October 2026 (version subprocessors-2026-10-12). These are the companies that handle information for SourceSecure. Text from AI chats is sent only for the optional AI features, and only after the names and numbers found in it have been replaced with stand-ins on the user's own computer; it passes through our server on Google Cloud without being stored, and OpenAI is the only other company that receives it.
| Subprocessor | What it does for SourceSecure | Information it receives | Where |
|---|---|---|---|
| Google LLC (Google Cloud, Firebase) | Website hosting, database, sign-in, server functions, logs | Staff email addresses and sign-in records; team, seat and invitation records; catch and pause records (masked); usage counts; the firm's word lists, profile and playbook; redacted text for AI features, in passing and not stored; server logs (no message text) | Database and server functions: Montreal, Canada (northamerica-northeast1). Website delivery and sign-in: Google's network |
| OpenAI, L.L.C. | Writes coaching tips and prompts, reply marks, vault facts, the weekly note, Ask SourceSecure answers, chat and meeting summaries, and the background in Add notes | Redacted text only, with stand-ins in place of the names and numbers found; no account details; sent with OpenAI's storage option switched off. OpenAI may keep its own abuse-monitoring logs of these requests for up to 30 days under its standard API terms; SourceSecure has asked OpenAI for zero data retention | United States |
| Stripe, Inc. | Payments, invoices and subscriptions | Buyer's name, email, card and billing address, entered on Stripe's own checkout page; the firm's name, seat numbers and the versions of our terms it agreed to | United States and Canada |
| Resend (Plus Five Five, Inc.) | Delivers sign-in links, invitations, the monthly report email (with the compliance report for team heads) and notices about a subscription ending | Recipient email addresses and the email's contents (never text from AI chats) | United States |
Changes to this list
We email every firm's admins at least 30 days before we add or replace a subprocessor. A firm that objects on reasonable privacy grounds may end the affected service and receive a refund of fees prepaid for the period after it ends, as set out in the Data Processing Agreement.
What is not on this list
The AI chat sites themselves (ChatGPT, Claude, Copilot, Gemini and others) are not SourceSecure's subprocessors: your staff use them directly under your firm's own accounts and terms. SourceSecure's job is to reduce what reaches them.
Getting in touch
Email support@sourcesecure.ca. SourceSecure is operated by JOLIVE Labs Inc.