Sub-processors
When you answer a survey or poll served by Septenar, your responses are processed on the infrastructure listed here. This register names each third party that handles platform data, the services it provides, and where it operates.
Amazon Web Services (AWS Canada Inc.)
- Operating jurisdiction
- Canada (ca-central-1 — Montreal)
- Parent entity
- Amazon Web Services, Inc. — United States (Delaware)
- Services
- EC2 / ECS (compute) · DynamoDB (submission storage) · S3 (file storage, exports, executed-PDF storage) · SES (transactional email; customer campaign email from two dedicated sending accounts in the same region — RFC-0052) · SQS (message queue) · ElastiCache (Valkey cache) · Aurora (PostgreSQL metadata) · STS (token service) · Bedrock (in-region AI inference) · Translate (in-region machine translation) · Secrets Manager · KMS (key management) · CloudWatch (metrics, logs) · CloudTrail (audit)
- Data handled
- All platform-held customer data · All platform-held participant data · Submission content (DynamoDB) · Audit logs (DynamoDB) · AI prompts and responses (Bedrock In-Region) · Account and App metadata (PostgreSQL) · File uploads (S3)
- Contractual instruments
- AWS Customer Agreement · AWS Service Terms · AWS Data Processing Addendum (DPA) · AWS Bedrock-specific terms
- Cross-border status
- Operating entity in Canada; parent entity in US. Sovereignty exposure: residual US legal-process risk through the parent, mitigated by AWS's public commitments to challenge unlawful requests and notify customers where permitted. Not eliminated. Septenar's §17 assessment (Law 25) acknowledges this residual.
- Law 25 §17 assessment
- AWS Canada Inc. operates from ca-central-1 (Montreal). Adequacy under PIPEDA-equivalent provincial framework. Residual US-parent legal-process exposure named honestly; mitigated by AWS contractual commitments. Continued use determined adequate for Law 25 transfer-of-equivalent-protection requirement.
Amazon Web Services (global services)
- Operating jurisdiction
- Global (AWS, Inc. directly)
- Parent entity
- Amazon Web Services, Inc. — United States (Delaware)
- Services
- CloudFront (edge content delivery) · Route 53 (DNS) · IAM (identity policies) · ACM (TLS certificates)
- Data handled
- Edge-cached public-by-design content (theme and brand-kit assets, builder profile images, build assets) · DNS records (no PII) · Identity policy metadata (no PII) · TLS certificate metadata (no PII)
- Contractual instruments
- AWS Customer Agreement · AWS Service Terms · AWS Data Processing Addendum (DPA)
- Cross-border status
- Global AWS services operating from AWS, Inc. (US). Edges carry application and API traffic uncached and cache only public-by-design content. Participant uploads are denied to CloudFront at the bucket policy (DenyCloudFrontParticipantUploads) and are reached only through a builder-gated five-minute pre-signed S3 URL, so no participant data is cached at an edge. There is no CloudFront URL signing. DNS / IAM / ACM carry no participant data.
- Law 25 §17 assessment
- No participant data persists in global AWS services. Edge caches hold public-by-design content only; participant uploads are denied to CloudFront at the bucket policy. DNS / IAM / ACM carry operational metadata only. Not subject to section 17 cross-border transfer assessment because the categories that trigger it - personal information about Quebec residents - do not flow to these services.
Stripe, Inc.
- Operating jurisdiction
- United States
- Parent entity
- Stripe, Inc. — United States (Delaware)
- Services
- Subscription management · Invoice generation · Payment processing · Dunning sequence
- Data handled
- Billing-contact name (customer-side, not participant) · Billing-contact email (customer-side, not participant) · Payment method metadata (last 4, brand, expiry)
- Never processed here
- Participant survey responses · Pool membership data · Audit trails · AI prompts and responses
- Contractual instruments
- Stripe Services Agreement · Stripe Data Processing Addendum · Standard Contractual Clauses (where applicable)
- Cross-border status
- US-based processor. The data that flows to Stripe is the customer's own billing relationship with Septenar (the email, name, and card of the account owner or billing-administrator role). No participant data ever reaches Stripe.
- Law 25 §17 assessment
- Stripe receives customer billing-contact data (not participant data). For Apps with Quebec participants where the customer is a Quebec-based organization, the customer's billing-contact data crosses the border under standard contractual clauses and Stripe's DPA. Adequacy determination based on Stripe's certified compliance posture (PCI DSS Level 1, SOC 2 Type II) and the contractual SCCs. Participant data does not flow to Stripe; the §17 scope is narrow to billing-contact data only.
Register version 1.3.0 — 2026-10-06 Adding or replacing a sub-processor updates this register and notifies affected customers.
- 2026-04-12 — Initial register on incorporation. AWS ca-central-1, AWS global, Stripe.
- 2026-09-21 — SES moved from in-flight to live (staging 2026-08-17, production 2026-08-21, production sending access 2026-09-20). Amazon Translate added as an in-region service (RFC-0040 M5). Observability resolved CloudWatch-native (RFC-0040 D3, 2026-08-14): no new sub-processor; the under-review entry is closed. No new sub-processor entity and no new jurisdiction: no customer notification is triggered.
- 2026-09-22 — French overlay added to every entry: the register now feeds Schedule 2 of the bilingual legal-ops instruments, and an English-only register would have put an English sub-processor list into a French agreement. Corrected the aws-global entry, which still described edge caching as signed-URL gated - docs/DATA_SOVEREIGNTY.md section 2.1 recorded on 2026-09-14 that there is no CloudFront URL signing and never was, and that participant uploads are denied to CloudFront at the bucket policy. No sub-processor entity and no jurisdiction changed: no customer notification is triggered.
- 2026-10-06 — Customer campaign email moves to two dedicated AWS accounts, osum-sending-staging and osum-sending-production, in ca-central-1 under the same AWS Canada Inc. operating entity (RFC-0052 M5, D4), so that a sender-reputation pause can never reach the platform's own transactional email. The same sub-processor, the same region, the same contractual instruments; the SES line of the aws-ca-central-1 entry says so in both languages. No new sub-processor entity and no new jurisdiction: no customer notification is triggered.