No drama. Every lead accounted for.

Lead data, contact records, audit history, and backups are stored in Canada, in the Montreal region. The application that reads and writes them runs there too: every server function is pinned to the Montreal region, beside the database.

The exception, because rounding it off would make this page wrong: outbound email leaves the country. Lead notifications and the ADF deliveries we send on your behalf are handed to our email provider, which processes them in the United States. Moving to a Canadian email provider would close that path, and until it does we would rather say it is open.

Every lead stores a consent snapshot: the exact consent text, the timestamp, the IP address, and the URL where consent was given. When a compliance question arrives, the answer is already on the record.

Fields you mark sensitive are encrypted with AES-256-GCM before they reach the database, with versioned keys that never live in the codebase. Database access alone does not reveal them.

Every workspace's rows carry its tenant identity, and row-level security policies in Postgres enforce the boundary on every query. Isolation is not an application-code convention that a bug can skip; the database refuses cross-tenant reads.

The audit log, rule versions, and ladder versions are append-only, enforced by the database itself. Every change to routing rules creates a new version, and every lead records exactly which version placed it. Nothing rewrites the past.

Intake is idempotent, so a re-sent lead updates its record instead of duplicating it. Every delivery attempt carries a tracked status with retries and fallbacks on the record. Every rejection returns a machine-readable reason.

Ask us anything about how your data is handled from inside your workspace, or before you sign up, from the trial itself. It costs nothing to look.