Effective 9 October 2026
Updated 15 October 2026: Vercel also counts page views on the public pages of termsroom.com, without cookies and without identifying anyone.
Sub-processors
Everyone we rely on to run Termsroom. Your documents are not in this table at all. They stay in storage your organisation owns and controls, which is either your own Microsoft 365 tenant or your own S3 bucket, and no sub-processor below ever holds them.
| Service | What it does | Where | Attestation | Holds documents |
|---|---|---|---|---|
| Vercel | Application hosting and delivery, and page-view counts for the public pages (no cookies, nobody identified) | Configurable region | SOC 2 Type II | No |
| Supabase | Database, authentication, the negotiation record | Canada (ca-central-1) | SOC 2 Type II | No |
| Twilio | Phone verification at sign-in, and invitations and reminders by text message | United States | SOC 2 Type II, ISO 27001 | No |
| Resend | Sending invitations and reminders by email (a reference, a name and a link, never a document), and the details entered in a request or partner application form on the website | United States | SOC 2 Type II | No |
| Paddle | Payments and merchant of record. Billing details go to Paddle and never to us | United Kingdom and European Union | PCI DSS Level 1, SOC 2 Type II | No |
| Microsoft | Your own tenant: Entra, Teams, SharePoint | Your tenant, your region | Your existing agreement with Microsoft | Yes, yours |
Billing
Subscriptions are sold through Paddle, which acts as merchant of record. Paddle receives your billing contact, payment and tax details, in the locations set out in its own terms. It has no access to a negotiation, to the audit record or to your documents.
Changes
We will give customers at least 30 days’ notice before adding a sub-processor, by updating this page, by texting the mobile number your organisation administrator verified, and by email where we hold an address. If you object on reasonable grounds we will work with you to find an alternative, and if we cannot you may terminate and receive a refund of the unused portion of your term.
Cross-border processing
Twilio processes phone numbers in the United States for sign-in verification and to deliver invitations and reminders by text message. Resend processes email addresses in the United States to deliver invitations and reminders by email. Those messages carry a reference and a link and never a document, a clause or a position. Paddle processes billing and tax information under its own terms, which may place it outside Canada. The record is held in Canada; text messages, emails and payments are processed by their providers (Twilio, Resend and Paddle). Your documents are processed wherever your own tenant is configured, which is entirely your choice.
For each sub-processor located outside Quebec, we have carried out a privacy impact assessment and signed a written agreement governing the disclosure of personal information, as Quebec law requires.