A “sub-processor” is a third-party service provider that processes personal data on our behalf to help us deliver the CanProcX service. This page lists our current sub-processors and forms part of our Privacy Policy and Data Processing Agreement. We maintain signed data-processing terms (including GDPR Art. 28 obligations) with each sub-processor.
| Sub-processor | Purpose / processing activity | Data processed | Location(s) |
|---|---|---|---|
| Google Firebase / Google Cloud Platform (Google LLC / Google Ireland Ltd.) | User authentication (sign-in), application & bid-profile data storage (Firestore), hosting of the AI “Pax” agent (Cloud Run) | Account & contact data, company & bid-profile data, usage/log data | USA / global (regional Google infrastructure) |
| Anthropic, PBC (Claude models) | AI bid-drafting and tender-matching (large-language-model inference), accessed via Google Cloud under enterprise terms | Company & bid-profile inputs you submit for drafting/matching | USA |
| Stripe, Inc. (and Stripe Payments Europe, Ltd.) | Payment processing and subscription billing (Stripe Checkout) | Billing name/country, subscription status, card last-4 (full card data goes directly to Stripe; CanProcX does not store it) | USA / EU |
| Netlify, Inc. | Website & application hosting and content delivery (CDN) | Usage/log data, IP address, request metadata | USA / global CDN |
| Google Workspace (Gmail) (Google LLC) | Transactional, account, and support emails | Name, business email, message content | USA / global |
| Google Analytics (Google LLC) | Aggregate usage analytics - loaded only where you have given cookie consent | Pseudonymous usage/device data, cookie identifiers | USA / global |
Tender intelligence is drawn from public government sources - principally CanadaBuys (Government of Canada, under the Open Government Licence – Canada), and, for other regions, sources such as TED and Find a Tender. These are public data sources; they do not process your personal data on our behalf.
We may add, remove, or replace sub-processors as our service evolves. Where we engage a new sub-processor that processes personal data, we update this page. Business and defence customers under a Data Processing Agreement may request advance notice of, and the right to object to, new sub-processors as set out in that DPA. To request notification of changes, contact privacy@canprocx.ca.