Skip to main content
Processing locations, approved providers, and data-use restrictions are agreed for your deployment. Review the full data flow before connecting live information.

​
Agree the processing boundary

Specify where information is stored, processed, backed up, and accessed. Database location alone does not describe the full flow. Include inference, telemetry, search indexes, support access, exports, and disaster recovery. Record Canada-only requirements explicitly and check the whole boundary. Do not infer exclusive Canadian processing from a Canadian primary hosting region.

​
Suppliers and subprocessors

The deployment’s register should identify each legal entity, function, data received, locations, onward providers, retention, and safeguards. It should explain how material changes are communicated and reviewed. Providers may process information on behalf of an institution, act under their own obligations, or supply data under separate terms. An integration catalog entry is not a declaration that the provider receives data in every deployment.

​
Subprocessor categories

This public overview describes service categories and their potential data access. The confidential subprocessor register identifies the legal entities, services, processing locations, and safeguards applicable to your deployment. Request it through your AMLOK contact under a signed nondisclosure agreement (NDA). The applicable processing agreement and confidential register establish which services are used, where processing occurs, and the notice and review process for changes. Model-processing terms address permitted use, retention, and training restrictions for the relevant service. Contact privacy@amlok.io for the register, applicable provider assurance materials, and processing details. See security materials under NDA for the review process.

​
Cross-border processing

PIPEDA does not generally prohibit outsourcing processing outside Canada. The responsible organization remains accountable and must use contractual or other means to provide a comparable level of protection. Transparency and the transfer’s circumstances remain important. See the OPC guidance. Quebec adds assessment and agreement requirements for processing outside Quebec, including elsewhere in Canada. Review Quebec privacy.

​
Exit and portability

Agree export format, transition period, access removal, return or deletion, backup treatment, provider coordination, and completion evidence before deployment. Identify records subject to a legal hold or retention obligation.