Draft — to be reviewed by a lawyer specialized in privacy law before launch. The "Status" column is maintained by the founder; no agreement is deemed signed until it is checked.
The law requires that information disclosed to a provider (mandatary) be disclosed under a written contract specifying protection measures, use limited to the mandate and destruction at the end of the contract; and, for a disclosure outside Québec, that a privacy impact assessment conclude that protection is adequate (provisions to be verified: ss. 17 and 18.3 of the Act respecting the protection of personal information in the private sector). The platform PIA is kept in docs/legal/EFVP.md.
Provider list
| Provider | Role | Information | Location | Agreement to sign | Status |
|---|---|---|---|---|---|
| Supabase Inc. | database, authentication | all database content: accounts, rosters, statistics, audit log, MFA factors | Canada (AWS ca-central-1); staff and subprocessors in the United States | Supabase Data Processing Addendum (DPA), signed from the dashboard; list of its subprocessors | [ ] |
| Amazon Web Services (Supabase subprocessor) | infrastructure | same | Canada | covered by the Supabase DPA | — |
| Hostinger | virtual private server: application, worker, disk storage of videos | videos, viewing copies, server logs, local backups | [Hostinger VPS data centre to be confirmed] | Hostinger Data Processing Agreement (terms of service and GDPR annex); confirm the data centre | [ ] |
| Modal Labs | GPU computing | video frames (transient blocks) | United States | Modal DPA; confirm deletion of volumes and that data is not logged | [ ] |
| Stripe | payments, billing | email, organization name, plan; card data (processed by Stripe only) | Canada and United States | Stripe Services Agreement + DPA (accepted with Stripe terms) | [ ] |
| Resend | transactional email (sign-in links, notices) | email address, email content | United States | Resend DPA | [ ] |
| Google (optional sign-in) | identity provider | email, name, Google ID | per Google | Google Identity terms; no team data sent | [ ] |
| Cloudflare R2 or OVHcloud (planned) | object storage for videos | videos, viewing copies | to be decided (OVHcloud Beauharnois for Canadian residency) | DPA of the chosen provider, before going live | [ ] |
| External monitoring provider (planned) | uptime checks | no personal information (public health endpoint) | — | none required if no data | — |
Minimum clauses to check in each agreement
- Processing only on UFStats' instructions and for the mandate; no reuse (including no model training by the provider).
- Confidentiality of staff and need-to-know access.
- Security measures (encryption in transit and at rest, access control, logging).
- Incident notice without delay to UFStats (specific deadline, e.g. 72 hours at most).
- Subprocessors: list, prior notice of changes, same obligations.
- Processing location and transfers; ability to require Canada for the Institution plan.
- Destruction or return at the end of the contract, with a certificate on request.
- Cooperation with access and correction requests and with investigations by the Commission d'accès à l'information.
- Audit right or independent audit reports (SOC 2, ISO 27001).
Record keeping
The founder keeps a PDF copy of each signed agreement (outside Git), the signature date and the annual review date. Any new category of provider requires a PIA update before information is first disclosed.