This page lists the sub-processors Conformaze engages to operate the service. Each sub-processor is bound by a written agreement imposing obligations equivalent to those Conformaze accepts toward its clients (article 18.3 of Law 25 / article 28 GDPR). Any change to this list is notified 30 days in advance to clients who signed our DPA. You can subscribe to these notifications by emailing dpo@conformaze.com.
Hosting
| Sub-processor | Purpose | Location | Data categories |
|---|
| Microsoft Azure (Canada Central / Canada East) | Application hosting, compute and orchestration. | Canada (Toronto / Quebec) | All data processed by the platform (registries, documents, access logs). |
| Replit Deployments | Front-end hosting and execution of Conformaze containers. | United StatesOutside Canada | Incoming HTTP traffic, technical access logs (no persistent user content). |
File storage
| Sub-processor | Purpose | Location | Data categories |
|---|
| Azure Blob Storage (Canada Central) | Storage of supporting documents, exports and uploaded files. | Canada (Toronto) | Documents, supporting evidence, PDF/CSV exports of registries. |
Payments
| Sub-processor | Purpose | Location | Data categories |
|---|
| Stripe Payments Canada Ltd. | Payment processing (card, ACSS debit) and invoicing. | Canada (Stripe Canada) with operational access by Stripe Inc. (United States).Outside Canada | Name, email, payment data, transaction history. |
Transactional email
| Sub-processor | Purpose | Location | Data categories |
|---|
| Mailgun (Sinch Email) | Transactional email delivery (verification, passwords, notifications). | United StatesOutside Canada | Recipient email, message content, delivery metadata. |
AI
| Sub-processor | Purpose | Location | Data categories |
|---|
| Azure OpenAI Service (Canada East) | AI suggestions and assistants (drafting, classification, recommendations). | Canada (Quebec) | Content of user-submitted prompts (registries, descriptions, drafts). Data is not used to train models. |
Telemetry
| Sub-processor | Purpose | Location | Data categories |
|---|
| Microsoft Application Insights (Azure Monitor) | Service observability and technical monitoring (JS errors, exceptions, AJAX calls, performance, frontend/backend correlation). Not used for audience measurement and stores no cookies (`disableCookiesUsage` enabled). | Canada (Toronto) | Technical error and performance traces, request metadata, pseudonymized correlation IDs. |
Transfers outside Canada
Sub-processors marked Outside Canada may process data outside Canada. As required by article 17 of Law 25, Conformaze performs a documented privacy impact assessment for each such transfer and requires equivalent contractual safeguards (standard clauses, relevant certifications). An up-to-date list of assessments is available on request from the Privacy Officer at dpo@conformaze.com.
Change notifications
To subscribe to sub-processor change notifications (30-day notice), send your address to dpo@conformaze.com with subject “Subprocessor notifications”.