Data Residency & Third-Party Processing

1. Purpose and Scope

This disclosure describes:

• Where Cloudspace and Webfire host customer workloads and related operational records
• Material external service providers that may process customer or contact information
• The purpose, nature of access, and known or potential countries of processing for each provider

It covers the services and configurations described as of the date at the top of this page. This disclosure does not constitute a guarantee that all communications or third-party processing occur exclusively within Canada.

2. Canadian Infrastructure and Data Residency

2.1 Hosting Infrastructure

We operate our physical production compute, storage, network, and customer authoritative DNS infrastructure in Edmonton, Alberta, Canada. Customer VPS and hosting workloads are maintained on this infrastructure.

Encrypted offsite backups are maintained at a physically separate location in Edmonton. Connectivity to the offsite backup system is protected by a site-to-site IPsec VPN.

2.2 Company-Operated Systems

The following are operated on company-controlled Canadian infrastructure:

• The HostBill customer account and support platform, including its application databases and backups
• Self-hosted mail services
• Our self-hosted PBX phone system, including locally retained voicemail and call recordings
• Internally managed security logging
• Customer authoritative DNS zones, using self-hosted PowerDNS and/or DirectAdmin (no external customer secondary DNS provider is used)

2.3 What These Statements Cover

These statements concern systems controlled by Cloudspace and Webfire. External services used for payments, domain registration, certificate issuance, telecommunications, and limited company infrastructure monitoring have separate processing arrangements, described in Section 4.

3. Personnel Access and Vendor Support

3.1 Our Staff

Administrators, employees, and contractors authorized to access hosted customer infrastructure are Canadian citizens physically located in Canada.

• Least privilege: Access is granted according to operational need
• Authentication: Staff accounts require multifactor authentication and strong passwords

3.2 HostBill Vendor Support

HostBill software support personnel in Poland may receive temporary, expressly authorized access to the HostBill application or server for troubleshooting. When this happens:

• Access is ordinarily HTTPS-only. SSH access may be provided for exceptional issues, and vendor SSH sessions are supervised and logged by our personnel
• Access is restricted to approved source IP address ranges
• Access is revoked when the support issue is resolved, including temporary credentials, firewall allowances, and active sessions

The HostBill-to-Proxmox integration operates with permissions restricted to its intended resources. Vendor support is not granted general Proxmox administrative access.

4. External Providers and Processing Register

The register below lists material external providers that may process customer or contact information.

4.1 Payments and Billing

4.2 Domains and Certificates

4.3 Telecommunications

4.4 Company Infrastructure Monitoring

4.5 Software Licensing and Vendor Support

4.6 AI-Assisted Operations

Stripe note: Stripe's jurisdiction is supported by the Stripe Data Processing Agreement (updated September 28, 2026). Its terms expressly identify transfers to Stripe, LLC in the United States and allow global transfers to affiliates and subprocessors; the complete processing-country footprint for a particular transaction is not specified.

5. Customer Communications, Security, and Website Services

5.1 Support and Email

Support tickets and associated emails are handled by our self-hosted HostBill platform and company-operated mail servers. No third-party cloud helpdesk or external email relay is used. Email sent to external recipients is necessarily subject to the receiving provider's systems and possible international routing.

5.2 Security Monitoring and Vendor Telemetry

Operational security monitoring and logs are managed internally. No third-party SOC, SIEM, endpoint detection, or log-analysis provider is used, and general-purpose hardware and network vendor call-home telemetry is not configured.

DirectAdmin, HostBill, and Proxmox do communicate with their respective vendors for licensing, subscription validation, and software update checks. These exchanges may expose limited licensing, installation, version, network-address, or other operational metadata; the exact transmitted fields and vendor processing locations have not been independently verified. They are distinct from an intentional export of customer-hosted files, databases, or virtual machine contents.

5.3 Our Websites and Billing Portals

Cloudspace and Webfire do not currently use external CAPTCHA, third-party analytics, advertising conversion tags, third-party website scripts, or external CDN services on our own sites and billing portals. Public DNS queries and public TLS certificates may nevertheless be observed by third parties as part of normal Internet operation.

5.4 AI Assistance

AI assistance may be used to support operations, customer communications, and troubleshooting.

• External providers: OpenAI and Anthropic may receive information deliberately submitted for those tasks, including relevant account or support context. Use of these services remains subject to each provider's terms, access, and geographic arrangements. Training is opted out and minimal retention is configured; actual retention remains subject to the applicable service terms and configuration.
• Private models: All privately operated AI models are hosted and executed exclusively on Cloudspace infrastructure in our Edmonton, Alberta data centre. Processing by those private models remains in Canada.
• Customer-hosted data: Direct access to customer-hosted workload data is undertaken only at the customer's request, typically for troubleshooting.

6. Boundaries and Qualifications

• Not every interaction stays in Canada: Canadian residency of hosted workloads and company-operated backups does not mean every customer interaction or transaction remains in Canada.
• Your own integrations: You may independently deploy external services, integrations, or remote access arrangements within your own workloads. Those choices are outside the scope of this disclosure.
• Providers can change: External vendor processing countries and downstream recipients can change. We will revise the register after outstanding provider-specific jurisdiction confirmations are received.
• Contractual requirements: If your contracts require Canada-only processing or access beyond the commitments stated here, those requirements must be expressly reviewed and agreed in writing before you rely on them.

7. Review and Contact

This disclosure reflects our operating environment as of October 19, 2026. It should be reconfirmed periodically or after material service changes.

Requests for additional processing details, contractual commitments, or security documentation can be directed to: