Skip to main content
Home
SIPSTACK Icon
Legal

Data Processing Addendum (Canada)

Last updated: 2026-10-05

1. Scope and Roles

This Canadian Data Processing Addendum (the "Addendum") supplements the SIPSTACK Terms of Service and applies where SIPSTACK Inc. ("SIPSTACK") processes Personal Information on behalf of a customer (the "Customer") that is subject to Canadian privacy law, including the federal Personal Information Protection and Electronic Documents Act ("PIPEDA") and Québec's Act respecting the protection of personal information in the private sector, as amended by Law 25 ("Law 25").

For the Personal Information processed under the Services, the Customer is the party that determines the purposes of processing and SIPSTACK processes that information on the Customer's behalf and on its instructions to deliver the Services. SIPSTACK also acts in its own right for limited operational purposes (billing, security, fraud prevention, and regulatory compliance) as described in the Privacy Policy.

"Personal Information" has the meaning given under PIPEDA and Law 25. "Customer Data" means the data the Customer and its users submit to or generate through the Services. "Sub-processor" means any service provider that SIPSTACK entrusts with processing Personal Information on the Customer's behalf.

2. Purpose and Nature of Processing

SIPSTACK processes Customer Data only to:

  • provide and operate the Services (telephony, messaging, AI, and portal features) the Customer has contracted for;
  • maintain, secure, and support the Services;
  • comply with legal and telecommunications-regulatory obligations; and
  • act on the Customer's documented instructions.

SIPSTACK does not sell Personal Information and does not use it for cross-context behavioural advertising. SIPSTACK does not use Customer Data to train AI model weights; AI knowledge-base improvement uses de-identified, human-reviewed content only, as described in the Privacy Policy.

3. Data Residency and Regional Model

SIPSTACK operates a regional data model for Customer user-generated content. For Customers billed under the SIPSTACK Canadian entity (CAD), user-generated content — call recordings, voicemail, music-on-hold, TTS audio, and other PBX media — is stored in Canada (Toronto region). SIP registration and call signaling for Canadian-region tenants are handled by Canadian-region signalling infrastructure; cross-region session border controllers carry SIP signaling only — no voice or message media transits an SBC.

A bounded set of operational data flows crosses the Canada–U.S. border. Each such flow is itemized in Schedule 1 with its purpose and safeguards. These are the flows assessed under Law 25, s. 17. A summary of the corresponding Privacy Impact Assessment is available to enterprise Customers on request, subject to confidentiality.

4. SIPSTACK Obligations

SIPSTACK will:

  1. process Personal Information only on the Customer's documented instructions and as described in this Addendum and the Privacy Policy;
  2. ensure personnel authorized to process Personal Information are bound by confidentiality and are granted access on a need-to-know basis;
  3. implement and maintain the technical and organizational security measures described in Schedule 2;
  4. assist the Customer, taking into account the nature of processing, in responding to requests from individuals exercising their rights and in meeting the Customer's own breach-notification and assessment obligations;
  5. notify the Customer without undue delay after becoming aware of a confidentiality incident (breach) affecting the Customer's Personal Information, with the information reasonably available to support the Customer's notification obligations under PIPEDA and Law 25;
  6. on termination of the Services, delete or de-identify Customer Data in accordance with the retention schedule in the Privacy Policy and applicable law. Call recordings, voicemail and other PBX media objects are deleted from object storage. Certain records are retained rather than deleted where law or regulation requires (billing and payment records, call detail records) or where they form an audit trail; in those records direct identifiers are removed or replaced. That process is pseudonymization, not anonymization: the resulting records remain Personal Information and remain linkable by SIPSTACK. Backup and disaster-recovery archives rotate on their own schedule, so a copy of a deleted record may persist in an archive for a limited period after deletion from the live system; and
  7. make available information reasonably necessary to demonstrate compliance with this Addendum.

5. Sub-Processors

SIPSTACK uses the Sub-processors listed in Schedule 1. Each Sub-processor is bound by a written agreement that requires it to protect the confidentiality of Personal Information, to use it only to perform the services SIPSTACK has engaged it to provide, to maintain appropriate security measures, to notify SIPSTACK without delay of any confidentiality incident, and to delete or return the information when the engagement ends. SIPSTACK remains responsible to the Customer for its Sub-processors' performance of these obligations.

SIPSTACK will provide notice of any intended addition or replacement of a sub-processor that processes Canadian Personal Information, giving the Customer a reasonable opportunity to object on reasonable data-protection grounds.

6. Communications Outside Québec and Canada

For transfers of Personal Information to the United States listed in Schedule 1, SIPSTACK relies on contractual safeguards equivalent to standard contractual clauses (SCCs) with each recipient, supplemented by technical measures (encryption in transit and at rest) and, where applicable, no-training and no-secondary-use commitments.

SIPSTACK has completed, or is completing, a privacy impact assessment under section 17 of the Act respecting the protection of personal information in the private sector for each flow listed in Schedule 1, and Schedule 1 states the status of each.

7. Individual Rights Assistance

The Services provide self-serve export and deletion tools (Switchboard → Account → Privacy), whose available scopes and limits are set out in the Privacy Policy. For requests that cannot be fulfilled self-serve, SIPSTACK will provide reasonable assistance to the Customer in responding to access, correction, withdrawal-of-consent, and deletion requests under PIPEDA and Law 25, taking into account the nature of the processing.

8. Audit

SIPSTACK will make available to the Customer information reasonably necessary to demonstrate compliance with this Addendum and, on reasonable prior written notice and subject to confidentiality, will respond to the Customer's reasonable inquiries (including security questionnaires) relating to its processing.

9. Governing Law

This Addendum is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein. Nothing in this Addendum derogates from, or limits, any right or protection conferred on a Customer or an individual by Québec's Law 25 or by any other applicable mandatory law; where a provision of this Addendum conflicts with such a law, that law prevails and the remainder of this Addendum continues in force.

10. Language

This Addendum is drawn up in French and English, and both versions are equally authoritative. If the versions are inconsistent, the French version prevails for a Customer located in Québec, unless that Customer, after being presented with the French version, expressly chose at acceptance to be bound by the English version; in every other case, the English version prevails.

Schedule 1 — Sub-processors and Cross-Border Data Flows

The following itemizes each flow of Canadian Personal Information that crosses the Canada–U.S. border, its purpose, the data involved, and the safeguard relied upon.

| # | Recipient | Destination | Purpose | Personal Information involved | Safeguard | |---|-----------|-------------|---------|-------------------------------|-----------| | 1 | Cloudflare R2 | United States | PostgreSQL WAL archive + base backups for point-in-time / disaster recovery | Incidental row-level PI inside binary WAL segments (not in queryable form) | Encryption in transit; provider-side encryption at rest (SIPSTACK holds no client-side key); bucket-scoped credentials; rolling ~14-day archive window. Assessment (s. 17) in progress. | | 2 | Sentry | United States | Application error / crash monitoring | Error messages and stack traces, device metadata, and — for errors raised while handling an API request — the request method, query string, body and session cookie | TLS; encryption at rest; production-only; redaction of error text and attached context. Request-context redaction is not yet implemented. Assessment (s. 17) in progress. | | 3 | Together AI | United States | Primary LLM inference for SARA AI text responses (support email, portal chat, SMS) | Inbound message content + RAG retrieval context | TLS; no-training commitment; transient processing. No customer opt-out from this routing exists today. Assessment (s. 17) in progress. | | 4 | Stripe | United States | Payment processing and billing | Billing address, payment method details (card data handled by Stripe; not stored by SIPSTACK) | Stripe DPA + SCCs; PCI-DSS. Assessment (s. 17) in progress. | | 5 | Bandwidth | United States | Voice/SMS carrier, DID provisioning, E911 | Phone numbers, in-transit call/message content, routing metadata | Carrier interconnection (telco-necessary); DPA + SCCs. Assessment (s. 17) in progress. | | 6 | HyperDX | United States | Application logging and observability | Application and server access logs, error diagnostics, request/response metadata, IP addresses (incidental PI in log payloads) | TLS; encryption at rest. Assessment (s. 17) in progress; recipient entity, storage region and vendor DPA pending confirmation. | | 7 | Cloudflare (CDN/DNS) | Global (transit) | CDN, DDoS protection, DNS, bot protection | Web traffic, IP addresses (transit only; no payload retention) | DPA + SCCs. Assessment (s. 17) in progress. | | 8 | PostHog | United States | Product analytics and support session replay for the customer portal and website | Portal user identity (name, email, role, organization), usage events, page addresses (with access tokens removed), and session recordings, which may include on-screen portal content | TLS; encryption at rest; access tokens stripped from addresses. Assessment (s. 17) in progress. | | 9 | Wasabi | Canada | Storage of user-generated content for Customers billed under the SIPSTACK Canadian entity (CAD) | Call recordings, voicemail, music-on-hold, TTS audio, and other PBX media | TLS; encryption at rest. Assessment (s. 17) in progress. |

Website analytics on sipstack.com (Google Analytics, subject to cookie consent) concern website visitors only and do not receive Customer Data.

Optional Text-to-Speech sub-processors (AWS Polly, Google Cloud TTS, United States) receive only text strings for synthesis, and only where the Customer enables those optional features. Mobile build/distribution (Expo / EAS, United States) receives build artifacts and app metadata, not Customer end-user data.

Schedule 2 — Technical and Organizational Measures

  • Encryption in transit: TLS 1.2+ for all API, portal, and SIP traffic.
  • Encryption at rest: Databases, object storage, and backups are encrypted at rest by the systems that hold them. The off-site database archive relies on the storage provider's server-side encryption; SIPSTACK does not hold a client-side encryption key for it.
  • Access controls: Role-based access control, MFA for administrative accounts, least-privilege, and access logging.
  • Segregation / residency: Regional object storage keeps Canadian-entity user-generated media in Canada; only the operational flows in Schedule 1 cross the border.
  • Security monitoring: Continuous monitoring and alerting, anomaly detection, and documented incident-response procedures.
  • Breach notification: Notification to affected individuals and authorities as required by applicable law (promptly for PIPEDA / Law 25; 72 hours for GDPR where applicable).
  • Retention and deletion: Tier-based auto-purge for recordings/voicemail; documented retention schedule; self-serve export and deletion tooling.