Sub-processor list

Last updated: 2026-10-10

Where the data lives

• The database, sign-in and file storage run at Supabase in AWS ca-central-1 (Montréal, Canada).
• The API runs as Vercel functions in Montréal (yul1). The static web app is served from Vercel's global edge network.
• Several features send personal information to vendors in the United States: AI reading and drafting, transcription, meeting recording, e-signature, phone calls and email delivery. Each one is listed below with what it receives.

What the AI providers receive

Two kinds of content go to AI providers, and only one of them is redacted first.

Text, redacted before it is sent. Prompts, notes, email content for inbox triage, meeting and call transcripts, and PDFs that have a usable text layer are sent as text. Before the text leaves, social insurance and social security numbers, dates of birth, full account numbers (the last four digits stay), phone numbers and email addresses are replaced with placeholders. Names, amounts, holdings and the rest of the content are sent as written, because the feature needs them. Ask WealthY's lookups into the firm's own records go through the same redaction, and any value filed under an email, phone, SIN, tax number or date-of-birth field is replaced whole.

Whole files and audio, not redacted. These are sent as they are, so they reach the provider with every identifier they contain:

• Scanned documents and photos (a passport, a driver's licence, a void cheque, a statement), and any PDF without a usable text layer, go to Google Gemini so the fields can be read. They can carry full ID numbers, account numbers, dates of birth, photos and addresses.
• A flat (scanned) form being filled goes to Google Gemini together with the client's name, email, phone, date of birth, KYC answers and account numbers, so the values can be placed on the page.
• Voice notes, and meeting recordings imported from Zoom or Microsoft Teams, go to Google Gemini for transcription, with OpenAI Whisper as the fallback when Gemini fails.
• Recorded phone calls go to OpenAI Whisper for transcription.
• Meetings recorded by the meeting bot or the desktop recorder are transcribed at Recall.ai itself; that transcript then reaches the AI provider as redacted text.

All of these providers process in the United States. Google's Gemini API terms allow prompts and responses to be stored for a short time in any country where Google has facilities.

Training. WealthY does not use client data to train AI models. Google's paid-tier Gemini API terms say API content is not used to improve Google's products; on the unpaid tier it can be, and people at Google may review it. Proof that WealthY's Gemini project is billed on the paid tier is not yet on file, so this page makes no no-training claim for Gemini until it is. Anthropic's and OpenAI's commercial API terms say API content is not used to train their models; WealthY relies on those standard terms.

Active sub-processors

How long vendors keep copies

WealthY can delete the copy a vendor keeps once its own copy is stored and checked. For Recall.ai, Documenso and Twilio these deletes are switched on vendor by vendor; until one is switched on, that vendor keeps its copy under its own terms (for Recall.ai, with no end date), and each copy kept is recorded.

• Recall.ai: once switched on, every new recording is created with a 72-hour retention window, after which Recall deletes the media itself, and WealthY asks Recall to delete it sooner, as soon as our copy of the transcript is stored and checked against what Recall sent.
• Documenso: once switched on, after the signed PDF is stored in WealthY and checked byte for byte, WealthY deletes the document from its Documenso account. Documenso hides a deleted, completed document rather than erasing the file, so erasure at Documenso itself still needs Documenso's written commitment or a self-hosted Documenso.
• Twilio: once switched on, a call recording is deleted at Twilio once WealthY's transcript of it is stored and checked.
• Google and Microsoft mailboxes: when an advisor disconnects Gmail, WealthY deletes its stored tokens and asks Google to end WealthY's access, unless the same Google account is still connected elsewhere in WealthY (on another seat, or for contact import). Microsoft offers no way to end a single grant from our side, so WealthY deletes its tokens and the advisor is shown where to remove WealthY's access in their Microsoft account.
• An operator setting can pause any of these deletes; while it is on, copies stay at the vendor until the vendor's own retention removes them. Every delete, and every copy kept because ours could not be checked, is recorded.
• Google Gemini, Anthropic, OpenAI and Resend keep what they receive under their own terms; WealthY makes no deletion request to them.

Integrations a firm or advisor connects

These run only when a firm or advisor connects its own account with the vendor, under the firm's own agreement with that vendor. Data moves between WealthY and that account as described.

Loaded by the visitor's browser

• Google Fonts (Google LLC): the app's pages load two typefaces from Google's font service, so the visitor's IP address and browser details reach Google.

In the code but switched off

• Sentry: the error-reporting library is in the code, but no project key is configured, so nothing is sent.
• Upstash: the rate-limiting library is in the code, but it is not configured in production; rate limits run in WealthY's own database.

Data processing agreements

No vendor data processing agreement has been executed and filed yet. Each vendor's own published terms apply today. When an agreement is executed it is filed and this page will say so for that vendor.

Vendor security reports (SOC 2, ISO 27001) are not yet on file either. Customers may ask for any that are on file, under NDA.

Sub-processor change notification

Customers are told in writing at least 30 days before a new sub-processor starts receiving Customer Data. The notice includes:

• Vendor legal name
• Service description
• Data categories processed
• Hosting location
• The Customer's right to object (and, if applicable, terminate)

Residency choices

• A meeting is recorded only when the advisor, or the firm's default, says to record it; nothing reaches Recall.ai otherwise.
• The dialer is off until the firm sets it up, so Twilio and call transcription receive nothing until then.
• The integrations above receive nothing unless the firm or advisor connects them.
• There is no per-firm switch today that keeps AI features from reaching the US providers above.
• Questions about residency: sales@wealthy.to.

Change log

1001536620 Ontario Corp., carrying on business as WealthY · Trust Center · Privacy policy · Ownership and legal information