Subprocessors
csr eco solutions uses the service providers below ("subprocessors") to run recovery. A subprocessor is a third party that handles personal information in Client Data, or in Authorised Users' account details, on our behalf. Each one is bound by a written agreement to protect that information and to use it only to provide its service to us. We remain responsible for what they do with it.
Client Data is stored in Toronto, Canada. Some supporting services, listed below, process limited information in the United States. Information held outside Canada is subject to the laws of that country and may be accessed by its courts, law enforcement and national security authorities.
| Provider | What it does for recovery | Information it handles | Where |
|---|---|---|---|
| Vultr (The Constant Company, LLC) | Hosts the application servers and the database | All Client Data; Authorised Users' account details; sign-in and security records | Canada (Toronto) for the primary database |
| Twilio SendGrid (Twilio Inc.) | Sends recovery's email: invitations, sign-in and security notices, replies to access requests, and requests sent from the Contact Us form to our support team | Recipient name and email address; the content of the message; delivery records | United States |
| Mapbox (Mapbox, Inc.) | Standardises a project's site address, finds its map position, and draws the map | The site address and map position of a project; when an Authorised User uses address search or the interactive map, that person's network address and browser details | United States |
| Stripe (Stripe Payments Canada, Ltd.; Stripe, LLC for personal data) | Takes card payments for paid plans and calculates sales tax; sends receipts and invoices | Billing contact name and email address; billing address and tax number; card details, which go straight to Stripe | Canada and the United States |
| Cloudflare (Cloudflare, Inc.) | Runs the Turnstile check on the sign-up page, to tell a person from a script | The network address and browser and device details of the person signing up | United States |
| Microsoft (Microsoft Corporation) | csr eco solutions' staff sign-in and staff mailboxes, including the mailbox that receives Contact Us requests; holds the documents a Customer gives us to load its historical projects | Staff account details; messages you send to our team; those documents | Microsoft 365, a Microsoft service; data location per Microsoft's published regions |
Not subprocessors. A channel partner or other person you choose to share results with receives Client Data on your instruction, not ours. Providers that help us run the service but do not handle Client Data or account details (for example our code hosting and our password manager) are not listed here.
Changes to this list. Before a new subprocessor starts to handle Client Data or account details, or an existing one starts to do so in a new country, we will:
- update this page, with the date and a line in the change log below; and
- email the owners and administrators of each Customer account, at least 30 days beforehand.
If you object on reasonable data-protection grounds, tell us at dpo@csrecosolutions.com within that period. Your Data Processing Addendum sets out what happens next.
If we must replace a subprocessor urgently to keep the service secure or available, we will tell you as soon as we can, and your right to object runs from that notice.
Removing a subprocessor, or a change that does not affect Client Data or account details, is recorded in the change log without advance notice.
Change log
| Date | Change |
|---|---|
| 2026-11-06 | First published. |