Data Processing Agreement (DPA)

1. Purpose and scope

This Data Processing Agreement ("DPA") defines the respective obligations of BorealHost.ai and its clients ("Data Controller") regarding the processing of personal data in the context of providing web hosting services and artificial intelligence modules.

This DPA supplements the Terms of Use and Privacy Policy of BorealHost.ai and applies to the extent that BorealHost.ai processes personal data on behalf of the client.

2. Role definitions

2.1 Data Controller

The client is the data controller for the personal data of their end users. The client determines the purposes and means of processing data hosted on our servers.

2.2 Data Processor

BorealHost.ai acts as a data processor and processes personal data only according to the client's instructions and in the context of providing hosting services.

2.3 Sub-processors

BorealHost.ai uses sub-processors for certain aspects of service delivery. The complete list is presented in section 4.

BorealHost.ai notifies the client of any addition or replacement of a subprocessor at least thirty (30) days before it takes effect, by email or by notification in the control panel. A client who objects to a change on reasonable data protection grounds may terminate the affected service before the effective date and obtain a pro rata refund of the unused prepaid portion. This period may be shortened where a change is urgently required for security or service continuity reasons, in which case the client is informed without delay.

BorealHost.ai imposes on its subprocessors data protection obligations at least equivalent to those of this agreement and remains liable to the client for their performance.

3. Obligations of BorealHost.ai

• Process personal data only according to the client's documented instructions
• Ensure the confidentiality of processed personal data
• Implement appropriate technical and organizational security measures
• Assist the client in responding to data subject rights requests
• Notify the client within 72 hours in the event of a data breach
• Delete or return personal data at the end of the contract, at the client's request
• Allow reasonable audits to verify compliance with this DPA

4. List of sub-processors

BorealHost.ai uses the following sub-processors in the delivery of its services:

Sub-processor	Function	Data processed	Location
Leaseweb Canada Inc.	Hosting infrastructure (data centres, servers, network)	All hosting data at rest and in transit	Canada (Montreal)
Backblaze, Inc.	Storage of encrypted backups and snapshots	Encrypted backups of client sites and databases	Canada (ca-east region)
Cloudflare, Inc.	Content delivery network, DNS and web application firewall	Request metadata, visitor IP addresses, traffic in transit	Global network (Canadian termination prioritised)
Stripe	Payment processing	Name, email, billing address	United States; transfers to other countries may occur depending on the Stripe services.
Sources Stripe : Stripe DPA · Stripe Privacy Center
Google LLC (Analytics)	Web traffic analysis	IP address (anonymized), pages visited	United States
Meta Platforms, Inc.	Marketing and conversion tracking	Conversion events (anonymized)	United States
OpenAI, Inc.	Traitement IA (SEO, contenu)	Content submitted to AI modules	United States
Anthropic, Inc.	AI processing (agents, code)	Content submitted to AI modules	United States
Google LLC (AI)	AI processing (Gemini)	Content submitted to AI modules	United States
DeepSeek	AI processing	Content submitted to AI modules	China
Moonshot AI (Kimi)	AI processing	Content submitted to AI modules	China
xAI (Grok)	AI processing	Content submitted to AI modules	United States

5. International data transfers

5.1 Hosting data

Client hosting data (files, databases, snapshots) is stored and processed in Canada, in data centres located in Montréal, Québec.

Off-site backups are encrypted before transmission and stored in the Canadian region of our object storage provider. Encryption keys remain under the exclusive control of BorealHost.ai and are not disclosed to the storage provider.

Web traffic transits a global delivery network whose points of presence may be located outside Canada; requests originating in Canada are routed preferentially to Canadian points of presence. Only request metadata and content in transit are involved: no hosting data is persistently retained there, other than items cached by the client.

BorealHost.ai's own account and billing data held with its providers is corporate information belonging to BorealHost.ai and contains no personal information concerning BorealHost.ai's clients or their end users.

5.2 AI data

When you use the artificial intelligence modules, submitted data (prompts, messages) is transmitted to the AI providers listed in section 4. These transfers are carried out with the following protective measures:

• Encryption in transit (TLS 1.3)
• Data minimization: only the content necessary for processing is transmitted
• Contractual clauses with US-based providers
• Explicit consent required for China-based providers
• No personal data is transmitted to AI providers without explicit user action

6. Breach notification

In the event of a personal data breach, BorealHost.ai commits to:

1. Notify the client within a maximum of 72 hours after the discovery of the breach
2. Provide available details on the nature of the breach, the categories of data affected and the corrective measures
3. Cooperate with the client for notification to the Quebec Commission d'acces a l'information (CAI) and affected individuals, in accordance with Law 25
4. Take necessary measures to contain the breach and prevent its recurrence

7. Data deletion

At the end of the contractual relationship or at the client's request:

The final-backup recovery window is 30 days after deactivation. This is not a deadline for erasing every copy. Immutable backup copies may remain for several hundred days, until each copy’s retention lock expires. Billing records have a separate retention period.

• Grace period: 7 days after end of subscription to allow reactivation
• Billing data: retained for 7 years in accordance with legal and tax obligations

8. Security measures

Shared hosting plans place several sites in one container. Plans with a dedicated container provide a container for the customer. Access permissions and resource limits depend on the plan.

BorealHost.ai implements the following security measures:

• Encryption in transit: TLS 1.3 on all connections
• Access control: two-factor authentication (2FA), SSH keys
• Intrusion protection: fail2ban, iptables firewall
• Encrypted backups: automatic daily backups of sites and databases
• Vulnerability management: regular security updates
• Restricted access: principle of least privilege for all staff

9. Audits

The client may request reasonable information to verify BorealHost.ai's compliance with this DPA. Audit requests must be submitted in writing to [email protected] with 30 days' notice.

10. Contact

For any questions regarding this Data Processing Agreement:

• Data Protection Officer: [email protected]
• Address: BorealHost.ai, 165-1494 chemin de Chambly, Longueuil, QC J4J 3X3, Canada