Production subprocessors
| Provider and service | Purpose and data | Configured location and transfer boundary |
|---|---|---|
| Vercel, Inc. Vercel | Application hosting, server functions, web delivery, scheduled jobs, request routing, and bounded operational logs. | Production functions are pinned to Montréal (yul1). Edge delivery, control-plane, security, and support processing may occur outside Canada. |
| Supabase, Inc. Managed PostgreSQL | Durable merchant configuration, encrypted Shopify credentials, synchronized knowledge, redacted review data, operational events, usage, billing evidence, and aggregates. | The primary production database is configured in AWS Canada Central (ca-central-1). Provider control, support, and service operations may involve other locations under the applicable provider terms. |
| OpenAI Realtime and Responses APIs | Typed answers and voice answers when an OpenAI voice is selected, relevant public store context, generated replies, and provider safety monitoring. The application keeps API credentials on its server. | Processing is not represented as Canada-only. Provider retention and the app’s brief encrypted delivery cache are described in the privacy policy. |
| Upstash, Inc. Upstash Redis | Short-lived admission, concurrency, rate-limit, replay, idempotency, provider-pause, and pseudonymous device/network protection state. Encrypted typed-answer retry caches expire after 90 seconds; product references used for conversational follow-ups and the temporary encrypted conversation memory expire after 30 minutes. | The production Redis database is configured in AWS Canada Central (ca-central-1). Control-plane and support processing may occur outside Canada. |
| Google LLC Gemini API and Gemini Live | Live microphone and generated audio processing, model output, selected redacted translation or review generation, provider safety and abuse monitoring, and requested Live resumption state. | Processing is not configured or represented as Canada-only and may occur in other countries where Google or its providers operate. Provider-side retention is described in the privacy policy. |
Commerce platform and other infrastructure vendors
| Provider | Role | Boundary |
|---|---|---|
| Shopify Inc. and the applicable Shopify contracting entity | Merchant platform for app installation and authentication, catalog and policy APIs, Storefront API, app proxy, carts, checkout handoff, themes, managed pricing, and billing. | Shopify processes data under its merchant and platform terms and global infrastructure. VoiceAgent requests no customer, order, or payment-data scope. |
| Namecheap, Inc. | Domain registration and authoritative DNS for the azdigitalinc.com domain. | Namecheap is not used by the VoiceAgent runtime to store storefront audio, transcripts, catalog data, carts, or merchant configuration. DNS metadata can be processed through global infrastructure. |
Provider changes and questions
AZ Digital will update this page when a production provider, purpose, or configured location materially changes. Where reasonably practicable, a material new processing role will be disclosed before it is used for merchant or shopper information. A merchant can email support@azdigitalinc.comwith a provider, transfer, privacy, or data-processing question.