Sub-processors and Vendor Policy

1. Why this policy exists

A law firm that uses RealEstAi is responsible, under Alberta’s Personal Information Protection Act section 5(2), for what its service provider does with personal information, and that includes what RealEstAi’s own providers do. This policy exists so that a firm can see the whole chain.

2. The register

Every provider that receives customer or personal information is published in the register in our Privacy Policy, with its name, the country in which it processes the information and the purpose, in plain words, with the data elements sent. That register is the single source of truth. Providers are described there by the service they perform; the register by name is an annex to our data processing agreement and is given to customer firms under it.

The listing rule. A provider is listed when, and only when, the integration exists in the platform’s code, and it is removed when the integration is removed. The register is changed in the same release that adds or removes an integration.

3. What leaves Canada

At rest, everything stays in Azure Canada Central. In processing, information leaves Canada only to a listed provider for its stated purpose:

• United States: AI reading of documents, including images of government ID; AI drafting, question-answering and search indexing; SMS one-time codes and upload links; e-signature envelopes where a firm uses them; card payment of RealEstAi’s fees; and, where a firm connects its own account, the firm’s email, calendar and meeting providers.
• European Union: transactional email, including PDF attachments (France); Word-to-PDF conversion of completed documents (Spain).
• Canada: hosting (Microsoft Azure), identity verification, property data, address verification, the mortgage-instruction network used by Canadian lenders, and the Alberta and City of Calgary registries a firm instructs us to query.

Individuals are told at the point of collection: the ID-upload page states that the image is processed outside Canada and names the purpose.

4. The AI providers

Documents are read by two established AI providers through their business services. Under both providers’ published business terms, content sent through the service is not used to train their models. Copies are kept by the provider only to check for abuse and are deleted within 30 days. The result of the reading is stored inside your file on the platform, not with the provider. Every request is sent individually; nothing about a matter is cached with the provider. We re-read the providers’ terms at every vendor review and whenever a provider announces a change, and we name the providers to customer firms under the services agreement.

5. What we require of a provider

Before a provider receives customer or personal information, we record, with the source and the date:

• exactly what data is sent, from which parts of the platform, and whether it includes government ID, dates of birth, financial or privileged material;
• the country of processing and the country of the provider’s parent company;
• whether the provider acts on our instructions only, for the stated purpose;
• how long the provider keeps what we send, and whether that can be shortened;
• whether the provider may use the content to train or improve its services, and that it does not;
• the provider’s own sub-processor list and how changes are notified;
• the provider’s security evidence, such as a current SOC 2 report or ISO 27001 certificate;
• whether the provider must tell us about a security incident, and how quickly;
• the terms that apply to our account, with their version and date;
• a security contact for incidents; and
• how our data is returned and deleted at exit.

A new provider is approved by the Security Lead and added to the published register in the same change that adds the integration.

6. Hosting

The platform, its database and its documents are hosted by Microsoft Azure in Canada Central. Microsoft’s certifications cover the data centres, disk encryption and managed services; the application controls are RealEstAi’s own. Microsoft is a US company, and information held in Canada may be subject to US legal process; we do not promise otherwise.

7. Business services

Source control and deployment, the domain registrar, company email and the password manager receive no customer matter data. Each is held under a personal account with multi-factor sign-in.

8. Review

Each provider is re-reviewed on a regular cadence, and at once when the provider reports a security incident or changes where it processes data. A review re-reads the provider’s terms, checks the country and retention position, confirms the security contact, and checks the provider’s own sub-processor list for changes.