1. Purpose and scope

This Data Processing Agreement ("DPA") defines the respective obligations of BorealHost.ai and its clients ("Data Controller") regarding the processing of personal data in the context of providing web hosting services and artificial intelligence modules.

This DPA supplements the Terms of Use and Privacy Policy of BorealHost.ai and applies to the extent that BorealHost.ai processes personal data on behalf of the client.

2. Role definitions

2.1 Data Controller

The client is the data controller for the personal data of their end users. The client determines the purposes and means of processing data hosted on our servers.

2.2 Data Processor

BorealHost.ai acts as a data processor and processes personal data only according to the client's instructions and in the context of providing hosting services.

2.3 Sub-processors

BorealHost.ai uses sub-processors for certain aspects of service delivery. The complete list is presented in section 4.

BorealHost.ai notifies the client of any addition or replacement of a subprocessor at least thirty (30) days before it takes effect, by email or by notification in the control panel. A client who objects to a change on reasonable data protection grounds may terminate the affected service before the effective date and obtain a pro rata refund of the unused prepaid portion. This period may be shortened where a change is urgently required for security or service continuity reasons, in which case the client is informed without delay.

BorealHost.ai imposes on its subprocessors data protection obligations at least equivalent to those of this agreement and remains liable to the client for their performance.

3. Obligations of BorealHost.ai

Process personal data only according to the client's documented instructions
Ensure the confidentiality of processed personal data
Implement appropriate technical and organizational security measures
Assist the client in responding to data subject rights requests
Notify the client within 72 hours in the event of a data breach
Delete or return personal data at the end of the contract, at the client's request
Allow reasonable audits to verify compliance with this DPA

4. List of sub-processors

BorealHost.ai uses the following sub-processors in the delivery of its services:

Sub-processor	Function	Data processed	Location
Leaseweb Canada Inc.	Hosting infrastructure (data centres, servers, network)	All hosting data at rest and in transit	Canada (Montreal)
Backblaze, Inc.	Storage of encrypted backups and snapshots	Encrypted backups of client environments	Canada (ca-east region)
Cloudflare, Inc.	Content delivery network, DNS and web application firewall	Request metadata, visitor IP addresses, traffic in transit	Global network (Canadian termination prioritised)
Stripe, Inc.	Payment processing	Name, email, billing address	United States
Google LLC (Analytics)	Web traffic analysis	IP address (anonymized), pages visited	United States
Meta Platforms, Inc.	Marketing and conversion tracking	Conversion events (anonymized)	United States
OpenAI, Inc.	Traitement IA (SEO, contenu)	Content submitted to AI modules	United States
Anthropic, Inc.	AI processing (agents, code)	Content submitted to AI modules	United States
Google LLC (AI)	AI processing (Gemini)	Content submitted to AI modules	United States
DeepSeek	AI processing	Content submitted to AI modules	China
Moonshot AI (Kimi)	AI processing	Content submitted to AI modules	China
xAI (Grok)	AI processing	Content submitted to AI modules	United States

Warning — China-based providers: DeepSeek and Moonshot AI (Kimi) are China-based providers. The use of these models requires separate explicit consent from you. Data transmitted to these providers is subject to Chinese data protection laws. We recommend not submitting sensitive personal data to these models.

5. International data transfers

5.1 Hosting data

Client hosting data (files, databases, snapshots) is stored and processed in Canada, in data centres located in Montréal, Québec.

Off-site backups are encrypted before transmission and stored in the Canadian region of our object storage provider. Encryption keys remain under the exclusive control of BorealHost.ai and are not disclosed to the storage provider.

Web traffic transits a global delivery network whose points of presence may be located outside Canada; requests originating in Canada are routed preferentially to Canadian points of presence. Only request metadata and content in transit are involved: no hosting data is persistently retained there, other than items cached by the client.

BorealHost.ai's own account and billing data held with its providers is corporate information belonging to BorealHost.ai and contains no personal information concerning BorealHost.ai's clients or their end users.

5.2 AI data

When you use the artificial intelligence modules, submitted data (prompts, messages) is transmitted to the AI providers listed in section 4. These transfers are carried out with the following protective measures:

Encryption in transit (TLS 1.3)
Data minimization: only the content necessary for processing is transmitted
Contractual clauses with US-based providers
Explicit consent required for China-based providers
No personal data is transmitted to AI providers without explicit user action

6. Breach notification

In the event of a personal data breach, BorealHost.ai commits to:

Notify the client within a maximum of 72 hours after the discovery of the breach
Provide available details on the nature of the breach, the categories of data affected and the corrective measures
Cooperate with the client for notification to the Quebec Commission d'acces a l'information (CAI) and affected individuals, in accordance with Law 25
Take necessary measures to contain the breach and prevent its recurrence

7. Data deletion

At the end of the contractual relationship or at the client's request:

Grace period: 7 days after end of subscription to allow reactivation
Final backups: retained for 30 days after deactivation
Permanent deletion: all data (files, databases, backups, configurations) is irreversibly deleted after the retention period
Billing data: retained for 7 years in accordance with legal and tax obligations

8. Security measures

BorealHost.ai implements the following security measures:

LXC container isolation: each hosted site is isolated in a dedicated container
Encryption in transit: TLS 1.3 on all connections
Access control: two-factor authentication (2FA), SSH keys
Intrusion protection: fail2ban, iptables firewall
Encrypted backups: automatic daily backups
Vulnerability management: regular security updates
Restricted access: principle of least privilege for all staff

9. Audits

The client may request reasonable information to verify BorealHost.ai's compliance with this DPA. Audit requests must be submitted in writing to [email protected] with 30 days' notice.

10. Contact

For any questions regarding this Data Processing Agreement:

Data Protection Officer: [email protected]
Address: BorealHost.ai, 165-1494 chemin de Chambly, Longueuil, QC J4J 3X3, Canada

Data Processing Agreement (DPA)