Sub-processors
This is a calculator, not an adviser. Read the full disclaimer.
Resonate Invoicing ("Resonate") is operated by <span class="pending-operator" title="Legal entity registration is pending">pending registration</span> (which appears as "pending registration" because formal business entity registration has not yet been completed). Resonate is a one-person operation currently in a pre-launch beta phase, based in Ontario, Canada, and subject to the federal Personal Information Protection and Electronic Documents Act (PIPEDA).
To provide software services to film and audiovisual technicians, Resonate relies on select infrastructure components and external service providers. We believe in total transparency regarding who handles your data and where it resides.
Sub-Processor and Infrastructure Registry
The following table details all third-party sub-processors, self-hosted infrastructure components, and related developer tools:
| Sub-processor | Purpose | Data they see | Location | Status |
|---|---|---|---|---|
| Helcim | Card payment processing | Card details entered directly into their hosted checkout, transaction amounts, and customer receipt name and email address | Canada (Calgary, AB) | Planned (payment processing is not yet built; the beta takes no payments) |
| Resend | Transactional and notification email delivery | Recipient email address and notification message content | United States / Global (delivery infrastructure may be located in the United States) | Active for beta email |
| Authentik | Identity and authentication | User email address, salted password hash, and tenant/role mappings | Canada (self-hosted in Ontario) | Active |
| MinIO | S3-compatible object storage for invoices, receipts, and attachments | User-uploaded files, PDFs, and attachments (encrypted at rest) | Canada (self-hosted in Ontario) | Active |
| Encrypted offsite backup | Disaster recovery and business continuity | Encrypted backup copy of application databases and object storage | Canada | Active |
| Hosting (Proxmox) | Primary server hardware and virtualization operated directly by us | All application databases, user records, and uploaded files | Ontario, Canada (self-hosted) | Active |
| JetBrains | Local development environment used on the operator's personal computer | None (this is local development software and is not a data processor) | N/A | N/A |
| Google Fonts | Not used (the application relies exclusively on local system fonts; no font requests leave the browser) | None | N/A | N/A |
Cross-Border Data Transfers
Our primary server infrastructure, identity management, storage, and backups are strictly located in Canada.
Helcim and Resend are the only parties outside of our direct infrastructure that ever receive personal information:
- Helcim is based in Calgary, Alberta, and processes payment data domestically within Canada.
- Resend operates delivery infrastructure that may route or store transactional email content in the United States. When personal information is processed in the United States, it may be subject to the lawful access requests of local courts and law enforcement agencies under applicable foreign laws. We protect this cross-border transfer by sending only necessary transactional content, enforcing transit encryption, and binding Resend to written data protection obligations.
Our Commitments
When you use Resonate, we make the following binding commitments regarding sub-processors:
- Complete Disclosure: We maintain and publish an exhaustive list of every sub-processor engaged to process personal information.
- 30 Days' Notice for Changes: We will provide you with at least 30 days' advance notice by email or prominent in-app notification before adding, replacing, or changing any third-party sub-processor.
- Right to Object: If you object to a proposed new sub-processor, you have the right to cancel your account without penalty and export all of your data (including CSV exports, PDFs, receipts, and machine-readable JSON) before the change takes effect.
- Written Contractual Safeguards: We require all external sub-processors to enter into written agreements that impose data protection, privacy, and confidentiality standards equivalent to our obligations under PIPEDA.
- Ongoing Accountability: We remain directly responsible and accountable to you for the actions, omissions, and compliance of any sub-processor we engage.
- No Third-Party Tracking: We do not use third-party analytics, marketing pixels, tracking scripts, ad networks, or external CDN-hosted fonts. Tenant isolation is strictly enforced at the database level. We do not hold SOC 2 or ISO 27001 certifications and do not claim to hold them.
Contact Us
If you have any questions or objections regarding our sub-processors, you can contact us directly:
- Privacy matters: [email protected]
- General inquiries: [email protected]