Effective 22 September 2026
Sub-processors
Everyone we rely on to run Termsroom. Your documents are not in this table at all. They stay in storage your organisation owns and controls, which is either your own Microsoft 365 tenant or your own S3 bucket, and no sub-processor below ever holds them.
| Service | What it does | Where | Attestation | Holds documents |
|---|---|---|---|---|
| Vercel | Application hosting and delivery | Configurable region | SOC 2 Type II | No |
| Supabase | Database, authentication, the negotiation record | Canada (ca-central-1) | SOC 2 Type II | No |
| Twilio | Phone verification at sign-in | United States | SOC 2 Type II, ISO 27001 | No |
| Resend | Sending invitations and reminders by email. A reference, a name and a link, never a document | United States | SOC 2 Type II | No |
| Paddle | Payments and merchant of record. Billing details go to Paddle and never to us | United Kingdom and European Union | PCI DSS Level 1, SOC 2 Type II | No |
| Microsoft | Your own tenant: Entra, Teams, SharePoint | Your tenant, your region | Your existing agreement with Microsoft | Yes, yours |
Billing
Subscriptions are sold through Paddle, which acts as merchant of record. Paddle receives your billing contact, payment and tax details, in the locations set out in its own terms. It has no access to a negotiation, to the audit record or to your documents.
Changes
We will give customers at least 30 days notice before adding a sub-processor, by updating this page, by texting the mobile number your organisation administrator verified, and by email where we hold an address. If you object on reasonable grounds we will work with you to find an alternative, and if we cannot you may terminate and receive a refund of the unused portion of your term.
Cross-border processing
Twilio processes phone numbers in the United States for sign-in verification. Resend processes email addresses in the United States to deliver invitations and reminders; the messages carry a reference and a link and never a document, a clause or a position. Paddle processes billing and tax information under its own terms, which may place it outside Canada. Everything else in our own stack is processed in Canada. Your documents are processed wherever your own tenant is configured, which is entirely your choice.