Skip to main content
Home
SIPSTACK Icon
Legal

Data Processing Addendum (Canada)

Last updated: 2026-10-09

1. Scope and Roles

This Canadian Data Processing Addendum (the "Addendum") supplements the SIPSTACK Terms of Service and applies where SIPSTACK Inc. ("SIPSTACK") processes Personal Information on behalf of a customer (the "Customer") that is subject to Canadian privacy law, including the federal Personal Information Protection and Electronic Documents Act ("PIPEDA") and Québec's Act respecting the protection of personal information in the private sector, as amended by Law 25 ("Law 25").

For the Personal Information processed under the Services, the Customer is the party that determines the purposes of processing and SIPSTACK processes that information on the Customer's behalf and on its instructions to deliver the Services. SIPSTACK also acts in its own right for limited operational purposes (billing, security, fraud prevention, and regulatory compliance) as described in the Privacy Policy.

"Personal Information" has the meaning given under PIPEDA and Law 25. "Customer Data" means the data the Customer and its users submit to or generate through the Services. "Sub-processor" means any service provider that SIPSTACK entrusts with processing Personal Information on the Customer's behalf.

2. Purpose and Nature of Processing

SIPSTACK processes Customer Data only to:

  • provide and operate the Services (telephony, messaging, AI, and portal features) the Customer has contracted for;
  • maintain, secure, and support the Services;
  • comply with legal and telecommunications-regulatory obligations; and
  • act on the Customer's documented instructions.

SIPSTACK does not sell Personal Information and does not use it for cross-context behavioural advertising. SIPSTACK does not use Customer Data to train AI model weights. SIPSTACK's shared SARA AI knowledge base is built only from SIPSTACK's own support interactions with its customers (resolved support tickets), and never from Customer Data that SIPSTACK processes on the Customer's behalf, such as the Customer's calls, messages and voicemail or the conversations of the Customer's own end users. Any knowledge base built from a Customer's own data is private to that Customer and is used only to provide the Services to that Customer.

3. Data Residency and Regional Model

SIPSTACK operates a regional data model for Customer user-generated content. For Customers billed under the SIPSTACK Canadian entity (CAD), user-generated content — call recordings, voicemail, music-on-hold, TTS audio, and other PBX media — is stored in Canada (Toronto region); for Customers billed under the SIPSTACK U.S. entity (USD), it is stored in the United States. SIP registration, call signalling and call media relay for Canadian-region tenants are normally handled by SIPSTACK's signalling and media-relay nodes in Toronto. Canadian-region tenants' call signalling may, however, transit SIPSTACK's U.S. nodes where a phone number is homed with the carrier on SIPSTACK's U.S. session border controller (SBC) or when traffic fails over to the U.S. nodes, and their call media may be relayed through the U.S. nodes on failover. SBCs carry SIP signalling only — no voice or message media transits an SBC.

A bounded set of operational data flows crosses the Canada–U.S. border. Each such flow is itemized in Schedule 1 with its purpose and safeguards. These are the flows assessed under Law 25, s. 17. A summary of each assessment SIPSTACK has completed is available to the Customer on request, subject to confidentiality (see section 6).

4. SIPSTACK Obligations

SIPSTACK will:

  1. process Personal Information only on the Customer's documented instructions and as described in this Addendum and the Privacy Policy;
  2. ensure personnel authorized to process Personal Information are bound by confidentiality and are granted access on a need-to-know basis;
  3. implement and maintain the technical and organizational security measures described in Schedule 2;
  4. assist the Customer, taking into account the nature of processing, in responding to requests from individuals exercising their rights and in meeting the Customer's own breach-notification and assessment obligations;
  5. notify the Customer without delay after becoming aware of any confidentiality incident affecting the Customer's Personal Information, and of any violation or attempted violation, by any person, of the obligations concerning the confidentiality of the Customer's Personal Information under this Addendum, with the information reasonably available to support the Customer's notification obligations under PIPEDA and Law 25;
  6. on termination of the Services, destroy or anonymize Customer Data as follows, in accordance with the retention schedule in the Privacy Policy and applicable law:
    • (a) billing and payment records and call detail records are retained in full for seven (7) years after the end of SIPSTACK's fiscal year in which they were created, for legal, tax, telecommunications-regulatory and fraud-prevention purposes, and are then destroyed. Audit logs, being the records of actions taken in the Services (such as sign-ins, administrative actions and account changes), are kept for two (2) years from the event they record, including after termination, for security, fraud-prevention, accountability and legal-claims purposes, and are then destroyed, except that audit records of billing and payment activity follow the seven-year rule in this paragraph;
    • (b) subject to paragraph (c), all other Customer Data is destroyed or anonymized no later than ninety (90) days after termination. Call recordings, voicemail and other PBX media objects are deleted from object storage. For this purpose, termination occurs when the last subscription on the Customer's account ends, in which case the account remains restorable for 90 days and that Customer Data is then purged, or when a cancellation of the Customer's entire account takes effect, in which case that Customer Data is purged 30 days after the cancellation takes effect;
    • (c) an individual user's login profile is not deleted or pseudonymized when the Customer's account ends, because that user may belong to other organizations or hold an account in their own right. SIPSTACK retains that profile, with its historical record, in its own right and not on the Customer's behalf, and the Privacy Policy, not this Addendum, governs it. This does not give the user continued access to the Customer Data of the organization whose account has ended; and
    • (d) Customer Data held in backup and disaster-recovery archives is purged on rotation, no later than ninety (90) days after its deletion from the live system; and
  7. make available information reasonably necessary to demonstrate compliance with this Addendum, and allow the verifications described in section 8.

5. Sub-Processors

SIPSTACK uses the Sub-processors listed in Schedule 1. Each Sub-processor is bound by a written agreement that requires it to protect the confidentiality of Personal Information, to use it only to perform the services SIPSTACK has engaged it to provide, to maintain appropriate security measures, to notify SIPSTACK without delay of any confidentiality incident and of any violation or attempted violation of its confidentiality obligations, and to delete or return the information when the engagement ends. SIPSTACK remains responsible to the Customer for its Sub-processors' performance of these obligations.

SIPSTACK will give the Customer at least thirty (30) days' prior written notice of any addition or replacement of a Sub-processor that processes Canadian Personal Information, and will update Schedule 1 accordingly. The Customer may object to the change in writing, on reasonable data-protection grounds, before it takes effect. If the objection is not resolved before the change takes effect, the Customer may terminate the affected Services by written notice, without penalty or early-termination fee.

6. Communications Outside Québec and Canada

For each communication of Personal Information outside Québec or Canada listed in Schedule 1, SIPSTACK has a written agreement with the recipient that requires it to keep the information confidential, to protect it with appropriate security measures, to use it only to provide the services SIPSTACK has engaged it to provide, and to return or destroy it when the engagement ends, together with standard contractual clauses where the recipient offers them. These agreements are supplemented by the technical measures described in Schedule 2, within the limits stated there, and, where Schedule 1 says so, by the recipient's commitment not to use the information to train AI models or for any purpose of its own.

SIPSTACK has completed, or is completing, a privacy impact assessment under section 17 of the Act respecting the protection of personal information in the private sector for each flow listed in Schedule 1, and Schedule 1 states the status of each.

Assistance with the Customer's own assessment. Personal Information communicated to SIPSTACK is processed outside Québec, mainly in Ontario and, for certain flows listed in Schedule 1, in the United States. For a Customer located in Québec, this is a communication outside Québec for which the Customer must itself conduct a privacy impact assessment under section 17 of that Act. On request, SIPSTACK will give the Customer the information reasonably needed for that assessment, including Schedule 1, the location of the systems that process the Customer's Personal Information, the security measures described in Schedule 2, the contractual protections described in section 5 and this section, and the summary of each assessment SIPSTACK has completed for a flow listed in Schedule 1, subject to confidentiality, and will answer the Customer's reasonable questions about those flows.

7. Individual Rights Assistance

The Services provide self-serve export and deletion tools (Switchboard → Account → Privacy), whose available scopes and limits are set out in the Privacy Policy. For requests that cannot be fulfilled self-serve, SIPSTACK will provide reasonable assistance to the Customer in responding to access, correction, withdrawal-of-consent, and deletion requests under PIPEDA and Law 25, taking into account the nature of the processing.

8. Audit

SIPSTACK will make available to the Customer the information reasonably necessary to demonstrate compliance with this Addendum, and will allow the Customer to carry out any verification reasonably required to confirm that SIPSTACK is complying with it, including by answering the Customer's written questions and security questionnaires and by allowing audits and inspections, conducted by the Customer or by an independent auditor bound by confidentiality, on at least thirty (30) days' prior written notice. Audits and inspections take place during normal business hours, no more than once in any twelve-month period except following a confidentiality incident or at the request of a regulator, and in a manner that does not disrupt the Services or compromise the security or confidentiality of other customers' information. They cover SIPSTACK's own premises and systems; for facilities operated by a Sub-processor, SIPSTACK will provide the information it obtains from that Sub-processor. Each party bears its own costs, except that the Customer pays the fees of any independent auditor it appoints.

9. Governing Law

This Addendum is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein. Nothing in this Addendum derogates from, or limits, any right or protection conferred on a Customer or an individual by Québec's Law 25 or by any other applicable mandatory law; where a provision of this Addendum conflicts with such a law, that law prevails and the remainder of this Addendum continues in force.

10. Language

This Addendum is drawn up in French and English, and both versions are equally authoritative. If the versions are inconsistent, the French version prevails for a Customer located in Québec, unless that Customer, after being presented with the French version, expressly chose at acceptance to be bound by the English version; in every other case, the English version prevails.

Schedule 1 — Sub-processors and Cross-Border Data Flows

The following lists each Sub-processor, wherever it is located, and each flow of Canadian Personal Information that crosses the Canada–U.S. border, with the recipient's location, the purpose, the data involved, and the safeguards relied upon.

| # | Recipient | Destination | Purpose | Personal Information involved | Safeguard | |---|-----------|-------------|---------|-------------------------------|-----------| | 1 | Cloudflare R2 | United States | PostgreSQL WAL archive + base backups for point-in-time / disaster recovery | Incidental row-level PI inside binary WAL segments (not in queryable form) | Encryption in transit; provider-side encryption at rest (SIPSTACK holds no client-side key); bucket-scoped credentials; rolling ~14-day archive window. Assessment (s. 17) in progress. | | 2 | Sentry | United States | Application error / crash monitoring | Error messages and stack traces, device metadata, the client IP address and — for errors raised while handling an API request — the request method and path | TLS; encryption at rest; production-only; before events leave SIPSTACK's systems, cookies, credential and authorization headers, request bodies and query strings are removed; IP-address scrubbing is not enabled at the provider. Assessment (s. 17) in progress. | | 3 | Together AI | United States | Primary LLM inference for SARA AI text responses (support email, portal chat, SMS) | Inbound message content + RAG retrieval context | TLS; no-training commitment; transient processing. No customer opt-out from this routing exists today. Assessment (s. 17) in progress. | | 4 | Stripe | United States | Payment processing and billing | Billing address, payment method details (card data handled by Stripe; not stored by SIPSTACK) | Stripe DPA + SCCs; PCI-DSS. Assessment (s. 17) in progress. | | 5 | Bandwidth | United States | Voice/SMS carrier, DID provisioning, E911 | Phone numbers, in-transit call/message content, routing metadata | Carrier interconnection (telco-necessary); DPA + SCCs. Assessment (s. 17) in progress. | | 6 | HyperDX | United States | Application logging and observability | Application and server access logs, error diagnostics, request/response metadata, IP addresses (incidental PI in log payloads) | TLS; encryption at rest. Assessment (s. 17) in progress; recipient entity, storage region and vendor DPA pending confirmation. | | 7 | Cloudflare (CDN/DNS) | Global (transit) | CDN, DDoS protection, DNS, bot protection | Web traffic, IP addresses (transit only; no payload retention) | DPA + SCCs. Assessment (s. 17) in progress. | | 8 | PostHog | United States | Product analytics and support session replay for the customer portal and website | Portal user identity (name, email, role, organization), usage events, page addresses (with access tokens removed), and session recordings, which may include on-screen portal content | TLS; encryption at rest; access tokens stripped from addresses; in the portal, all form inputs are masked in session recordings. Assessment (s. 17) in progress. | | 9 | Wasabi | Canada | Storage of user-generated content for Customers billed under the SIPSTACK Canadian entity (CAD) | Call recordings, voicemail, music-on-hold, TTS audio, and other PBX media | TLS; encryption at rest. Assessment (s. 17) in progress. | | 10 | Hivelocity | Canada (Toronto) | Dedicated data-centre hosting of SIPSTACK's primary infrastructure (primary database, application servers, self-hosted AI speech and language models, transactional email) | Essentially all Customer Data held in the primary database and services | TLS; encryption at rest. Assessment (s. 17) in progress. | | 11 | Hivelocity | Canada (Toronto) | Virtual servers running SIP registration proxy, session border controller and media-relay nodes for Canadian-region tenants | SIP registration and signalling data (phone numbers, extension identifiers, device IP addresses, call-routing metadata) and call media relayed through those nodes in transit | Signalling and media from SIPSTACK's Pulse apps encrypted in transit (TLS and DTLS-SRTP) as far as these nodes; signalling and media from desk phones, other provisioned devices and carriers not encrypted (see Schedule 2); call media handled in transit only. Assessment (s. 17) in progress. | | 12 | Apple Push Notification service (APNs) | United States | Delivering call, message and voicemail notifications to iOS devices running SIPSTACK's mobile app | Device push tokens; caller or sender name and number; notification title; for inbound text messages, a preview of up to the first 140 characters | TLS; token-based delivery; the provider's data-processing terms. Assessment (s. 17) in progress. | | 13 | Google Firebase Cloud Messaging (FCM) | United States | Delivering call, message and voicemail notifications to Android devices running SIPSTACK's mobile app | Same as row 12 | TLS; token-based delivery; the provider's data-processing terms. Assessment (s. 17) in progress. | | 14 | Hivelocity | United States (Tampa, Florida) | Virtual servers running the SIP registration proxy and media relay for U.S.-region tenants and SIPSTACK's carrier-facing session border controller (SBC). Canadian-region tenants' call signalling may transit these nodes where a phone number is homed with the carrier on the U.S. SBC or on failover, and their call media may be relayed through them on failover | SIP registration and signalling data (phone numbers, extension identifiers, device IP addresses, call-routing metadata) and call media relayed through those nodes in transit | Same as row 11. Assessment (s. 17) in progress. | | 15 | Wasabi | United States (us-east-1) | Storage of user-generated content for Customers billed under the SIPSTACK U.S. entity (USD) | Call recordings, voicemail, music-on-hold, TTS audio, MMS media and other PBX media | TLS; encryption at rest. Assessment (s. 17) in progress. | | 16 | IDT | United States | International outbound call termination | Calling and called numbers, caller ID, and the audio of the calls it carries, in transit | Carrier interconnection (telco-necessary); carrier service agreement; signalling and media not encrypted (see Schedule 2). Assessment (s. 17) in progress. | | 17 | VoIP.ms | Canada (Montréal, Québec) | Backup and international-failover outbound call carrier; supplier of phone numbers | Calling and called numbers, caller ID, and the audio of the calls it carries, in transit; the phone numbers it supplies | Carrier interconnection (telco-necessary); carrier service agreement; signalling and media not encrypted (see Schedule 2). Assessment (s. 17) in progress. | | 18 | Vultr | Canada (Toronto) | Secondary inbound mail server (MX) for sipstack.com email addresses | Email sent to SIPSTACK addresses (such as the support and privacy addresses), including the sender's address and the message content | The provider's data-processing terms. Assessment (s. 17) in progress. |

Website analytics on sipstack.com (Google Analytics, subject to cookie consent) concern website visitors only and do not receive Customer Data.

Optional Text-to-Speech sub-processors (AWS Polly, Google Cloud TTS, United States) receive only text strings for synthesis, and only where the Customer enables those optional features.

Schedule 2 — Technical and Organizational Measures

  • Encryption in transit: TLS 1.2 or higher for the API, the customer portal and the website. SIPSTACK's Pulse apps (mobile, desktop and web) use secure WebSocket (TLS) signalling and DTLS-SRTP encrypted media between the app and SIPSTACK's edge node; beyond that node, call media is not encrypted. Desk phones and other provisioned devices, and the interconnections with telecommunications carriers, use unencrypted SIP signalling and RTP media, as is standard for interconnection with the public telephone network. No communications are end-to-end encrypted.
  • Encryption at rest: Databases, object storage, and backups are encrypted at rest by the systems that hold them. The off-site database archive relies on the storage provider's server-side encryption; SIPSTACK does not hold a client-side encryption key for it.
  • Access controls: Role-based access control, MFA for administrative accounts, least-privilege, and access logging.
  • Segregation / residency: Regional object storage keeps Canadian-entity user-generated media in Canada; only the operational flows in Schedule 1 cross the border.
  • Security monitoring: Continuous monitoring and alerting, anomaly detection, and documented incident-response procedures.
  • Breach notification: Notification to affected individuals and authorities as required by applicable law (promptly for PIPEDA / Law 25; 72 hours for GDPR where applicable).
  • Retention and deletion: Tier-based auto-purge for recordings/voicemail; documented retention schedule; self-serve export and deletion tooling.