TherapyCRM subprocessors
Current as of October 9, 2026. TherapyCRM data is stored in Canada. The production application, database, uploaded files and backups are in Toronto and the session cache is in Canada. The rows outside Canada are the named exceptions: providers that process limited data to deliver their service, copies made before the October 2, 2026 move, and testing environments.
These providers support delivery of TherapyCRM. Locations describe known primary contracted processing and do not exclude transient routing or lawful provider support access. A location marked for verification is deliberately not a contractual location promise.
| Provider | Function | Processing location | Data categories |
|---|---|---|---|
| Google Cloud | Production application, database, network protection and operational logs | Canada (Toronto) | Application requests, account, practice and client information; redacted operational metadata |
| Hetzner Online GmbH | Testing and pre-release environments, and the rollback runtime retained until about November 1, 2026 | Germany | Non-production application requests, which can include copies of production records; retained rollback data |
| Neon, Inc. / Amazon Web Services | Non-production PostgreSQL and retained pre-cutover rollback copy, kept until about November 1, 2026 | United States | Non-production account, practice and client information, which can include copies of production records; frozen pre-cutover data |
| Redis Ltd. / Amazon Web Services | Session cache and rate limiting, and the queue for outgoing email | Canada | Session identifiers and security metadata; queued email jobs, which can include recipient addresses, message content and shared clinical document attachments |
| Google Cloud | Production private file storage | Canada (Toronto) | Uploaded clinical documents and media |
| Google Cloud | Production database backups and recovery | Canada (Toronto) | Copies of production account, practice and client information |
| Google Cloud | Backup exports made before the October 2, 2026 move to Canada | Germany (Frankfurt), until they are deleted under a 30-day rule about November 1, 2026; recoverable until about November 8, 2026 | Copies of pre-cutover account, practice and client information |
| Google reCAPTCHA | Abuse prevention on public forms, and on sign-in where it is turned on | Global; may be outside Canada | Browser and network signals, request action and security tokens. Form answers and patient records are not supplied to assessments. |
| Google Analytics | Optional measurement of public marketing pages, only after a visitor consents | Global; may be outside Canada | Public page paths, marketing interaction names and campaign labels; with separate ad-measurement consent, ad-click identifiers and verified inquiry, trial and first-payment outcomes. No form contents, clinical records or private screens. |
| Google (YouTube) | Playback of the video on the offer page, loaded from youtube-nocookie.com only when a visitor presses play | Global; may be outside Canada | The visitor's IP address, browser and device information, and how they interact with the video |
| Stripe, Inc. | Subscription billing, checkout and online invoice payment | United States and global payment network | Practice billing contact and payment information; for practices that offer online invoice payment, the payer's email address and payment details |
| Twilio Inc. / SendGrid | Transactional email and SMS | United States | Recipient address or phone number and message content |
| OpenRouter, Inc. | AI model gateway | United States | Minimised task text with the identifiers of people already in the practice's records, and identifier fields in record data, replaced; other details a user types, such as names, dates of birth, addresses or email addresses that do not match a record, are sent as typed, as is a phone number or email address a user types for the assistant to set or check and the details of a new lead a user asks it to create; images, such as scanned pages and photos uploaded to import records, sent as they are |
| OpenAI, L.L.C. and Anthropic, PBC | AI model inference; the only model providers the AI features can use | United States | The same task text and images, under API no-training commitments |
| 650 Industries, Inc. (Expo) | Mobile app push notification delivery and app updates | United States; confirm in the provider's data-processing terms before relying on a location commitment | Device push tokens, generic notification text and opaque identifiers; app version, device platform, installation identifier and network address when an app checks for updates |
| Apple Inc. | Push notification delivery through the Apple Push Notification service (platform provider) | Apple's global delivery network | Device push tokens and generic notification text |
| Google (Google Calendar) and Microsoft (Outlook / Microsoft 365, not yet enabled) | Optional calendar synchronisation that a practice chooses to connect | The calendar provider's own locations; may be outside Canada | Connected account identifier and access tokens; appointment copies labelled Appointment with times only; busy times read from the calendars staff select |
Changes and questions
TherapyCRM gives advance notice of material subprocessor changes through registered-user email and an updated Privacy Policy where required. Contact privacy@therapycrm.io for contract, location, or transfer questions before placing regulated information in the Services.