Data residency
Data Residency & Sub-processors
Academic Intelligence is designed from the ground up to meet the data sovereignty, privacy, and vendor risk management requirements of Canadian post-secondary institutions.
Last updated: October 2026
This page outlines our data boundaries, third-party sub-processors, and software continuity frameworks.
1. Data Residency Boundaries
We maintain clear, non-negotiable boundaries between where institutional data is stored at rest and how ephemeral processing occurs:
- Primary Database Storage: All active customer databases, policy libraries, draft documents, metadata, and user accounts reside in Supabase hosted within the AWS Canada (Central / Québec) region.
- Backup Snapshot Pinning: All automated daily database snapshots and disaster recovery backups are strictly pinned to Canadian regions (Québec / Ontario).
- Authentication & Identity: User credentials, single sign-on (SSO) sessions, and authentication logs are managed through Kinde utilizing their dedicated Canadian data cluster.
- Public Website & API Endpoints: Public site assets, form endpoint APIs, and Cloud Run services are hosted in Google Cloud Platform’s Montréal region (northamerica-northeast1). Public website telemetry and traffic analytics are processed via PostHog's EU cloud infrastructure (Frankfurt, Germany) and are strictly isolated from institutional customer databases and application environments.
- AI Processing Boundary: AI-assisted analysis runs exclusively via Google Gemini. When triggered on demand, text is transmitted via TLS encryption to secure Google Cloud facilities, processed ephemerally without being stored, and returned immediately.
2. Third-Party Sub-processors
Academic Intelligence engages a limited set of infrastructure and service sub-processors to deliver our platform. Each sub-processor is vetted for security compliance and bound by contractual terms ensuring data protection standards equivalent to our own.
| Sub-processor | Purpose / Function | Data Handled | Primary Location / Jurisdiction |
|---|---|---|---|
| Supabase (AWS) | Database Hosting & Storage | Customer policies, drafts, metadata, and application records | Québec, Canada |
| Kinde | Identity & Authentication | User names, work email addresses, and auth session tokens | Canada |
| Google Cloud Platform | Web & API Hosting (Cloud Run) | Public site forms, API endpoint routing logs, and static assets | Montréal, Canada |
| Google Cloud (Gemini) | Ephemeral AI Processing | Selected policy text submitted on-demand for AI analysis | United States (Ephemeral; zero retention) |
| PostHog, Inc. | Website Analytics & Performance Optimization | Pseudonymous web interaction telemetry, page views, referral sources, and device/browser metadata | Frankfurt, Germany (EU Cloud) |
Sub-processor Changes
Academic Intelligence will provide institutional client contacts with at least 30 days’ advance written notice prior to engaging any new sub-processor handling customer data, providing the opportunity to review security documentation.
3. Software Continuity & Source Code Escrow
We recognize that institutional continuity and vendor risk management are critical for post-secondary governance.
Standard Infrastructure Continuity
- Redundant Infrastructure: All active services run on redundant, managed cloud infrastructure with automated daily snapshots and a 30-day backup retention cycle.
- Isolated Version Control: Application source code and deployment configurations are securely maintained across offsite, multi-region code repositories.
Optional Source Code Escrow
To address long-term operational risk and business continuity requirements, institutions may opt into a dedicated Source Code Escrow Agreement via an independent third-party escrow provider (Praxis Technology Escrow).
- Access Guarantee: In the event of agreed-upon release triggers, the escrow agent releases the full platform source code, database schemas, and deployment documentation to the subscribing institution.
- Pricing: Setup and ongoing maintenance fees for source code escrow are billed directly as an optional add-on tier to the subscription agreement.
4. Inquiries & Vendor Assessments
For security questionnaires, DPA requests, or sub-processor inquiries, please contact privacy@academicintelligence.ca.