Subprocessors
The version in force today, at its own permanent address.
Effective 13 October 2026 ยท version subprocessors-2026-10-13
This is the version in force today, at an address that will keep showing these exact words after the document next changes. Every version.
Last updated 13 October 2026 (version subprocessors-2026-10-13). These are the companies that handle information for SourceSecure. Text from AI chats is sent only for the optional AI features, and only after the names and numbers found in it have been replaced with stand-ins on the user's own computer; it passes through our server on Google Cloud without being stored, and OpenAI is the only other company that receives it.
| Subprocessor | What it does for SourceSecure | Information it receives | Where |
|---|---|---|---|
| Google LLC (Google Cloud, Firebase) | Website hosting, database, sign-in, server functions, logs | Staff email addresses and sign-in records; team, seat and invitation records; catch and pause records (masked); usage counts; the firm's word lists, profile and playbook; redacted text for AI features, in passing and not stored; server logs (no message text) | Database and server functions: Montreal, Canada (northamerica-northeast1). Website delivery and sign-in: Google's network |
| OpenAI, L.L.C. | Writes coaching tips and prompts, reply marks, vault facts, the weekly note, Ask SourceSecure answers, chat and meeting summaries, and the background in Add notes | Redacted text only, with stand-ins in place of the names and numbers found; no account details; sent with OpenAI's storage option switched off. OpenAI may keep its own abuse-monitoring logs of these requests for up to 30 days under its standard API terms; SourceSecure has asked OpenAI for zero data retention | United States |
| Stripe, Inc. | Payments, invoices and subscriptions | Buyer's name, email, card and billing address, entered on Stripe's own checkout page; the firm's name, seat numbers and the versions of our terms it agreed to; the email address of the firm's owner | United States and Canada |
| Resend (Plus Five Five, Inc.) | Delivers sign-in links, invitations, the monthly report email (with the compliance report for team heads), notices about a subscription ending or a payment failing, and notices of a change to our terms | Recipient email addresses and the email's contents (never text from AI chats) | United States |
| Cloudflare, Inc. | Runs the addresses of sourcesecure.ca (DNS), and forwards email sent to support@sourcesecure.ca to our mailbox | Whatever a person writes to support@sourcesecure.ca, in passing; nothing from the product itself | United States, and Cloudflare's global network |
Changes to this list
We email every firm's admins at least 30 days before we add or replace a subprocessor. A firm that objects on reasonable privacy grounds may end the affected service and receive a refund of fees prepaid for the period after it ends, as set out in the Data Processing Agreement.
What is not on this list
The AI chat sites themselves (ChatGPT, Claude, Copilot, Gemini and others) are not SourceSecure's subprocessors: your staff use them directly under your firm's own accounts and terms. SourceSecure's job is to reduce what reaches them.
Getting in touch
Email support@sourcesecure.ca. SourceSecure is operated by JOLIVE Labs Inc.