> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amlok.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Hosting and subprocessors

> Review the complete data location and supplier chain for an AMLOK deployment.

Processing locations, approved providers, and data-use restrictions are agreed for your deployment. Review the full data flow before connecting live information.

## Agree the processing boundary

Specify where information is stored, processed, backed up, and accessed. Database location alone does not describe the full flow. Include inference, telemetry, search indexes, support access, exports, and disaster recovery.

| Component | Information to establish |
| - | - |
| Primary hosting | Provider, region, tenant boundary, and permitted data categories. |
| Backup and recovery | Regions, replication, access restrictions, retention, and restoration testing. |
| Model processing | Provider and service, inference location, logging, retention, and training terms. |
| Operational access | Countries from which personnel and suppliers may access information. |
| Integrations | Data returned or sent, permissions, provider role, and applicable agreement. |

Record Canada-only requirements explicitly and check the whole boundary. Do not infer exclusive Canadian processing from a Canadian primary hosting region.

## Suppliers and subprocessors

The deployment's register should identify each legal entity, function, data received, locations, onward providers, retention, and safeguards. It should explain how material changes are communicated and reviewed.

Providers may process information on behalf of an institution, act under their own obligations, or supply data under separate terms. An [integration catalog](https://docs.amlok.io/integrations.md) entry is not a declaration that the provider receives data in every deployment.

## Subprocessor categories

This public overview describes service categories and their potential data access. The confidential subprocessor register identifies the legal entities, services, processing locations, and safeguards applicable to your deployment. Request it through your AMLOK contact under a signed nondisclosure agreement (NDA).

| Service category | Purpose | Data categories, where applicable |
| - | - | - |
| Hosting and infrastructure | Application hosting, content delivery, edge security, storage, and recovery. | Application records, request metadata, and operational logs. |
| Payment and billing services | Subscription billing, checkout, and payouts. | Billing identity, payment references, and payout records. |
| AI and model processing | Authorized analysis and workspace assistance. | Approved prompts, selected context, and generated outputs. |
| Transactional communications | Service notifications and operational email. | Recipient details and message content. |
| Identity verification | Authorized document and liveness checks. | Identity attributes, documents, verification images, and results. |
| Financial-data connectivity | Authorized account connections and data retrieval. | Account information, balances, and transaction records. |
| Commerce-data connectivity | Authorized store connections and data retrieval. | Store, order, and refund information. |

The applicable processing agreement and confidential register establish which services are used, where processing occurs, and the notice and review process for changes. Model-processing terms address permitted use, retention, and training restrictions for the relevant service.

Contact [privacy@amlok.io](mailto:privacy@amlok.io) for the register, applicable provider assurance materials, and processing details. See [security materials under NDA](https://docs.amlok.io/security/due-diligence.md#security-materials-under-nda) for the review process.

## Cross-border processing

PIPEDA does not generally prohibit outsourcing processing outside Canada. The responsible organization remains accountable and must use contractual or other means to provide a comparable level of protection. Transparency and the transfer's circumstances remain important. See the [OPC guidance](https://www.priv.gc.ca/en/privacy-topics/airports-and-borders/gl_dab_090127/).

Quebec adds assessment and agreement requirements for processing outside Quebec, including elsewhere in Canada. Review [Quebec privacy](https://docs.amlok.io/security/quebec.md).

## Exit and portability

Agree export format, transition period, access removal, return or deletion, backup treatment, provider coordination, and completion evidence before deployment. Identify records subject to a legal hold or retention obligation.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.