Security & data

The database and files are hosted in Canada (Supabase, AWS ca-central-1 region, Montreal), with automatic daily backups. Some subprocessors process data in the United States: Anthropic (AI), Vercel (application hosting), Stripe (payments) and Resend (emails). Anthropic does not use data from its commercial API to train its models. Full list: privacy policy.

Yes, at any time and at no cost. A full account export (quotes, projects, clients, contacts, employees, invoices, subcontractors) takes one click. On top of that: CSV or Excel exports by module, Acomba and Sage 50 accounting exports, and a ZIP for each quote (PDF and attachments).

Your account goes back to the Free plan: your data is not deleted when you cancel and stays viewable and exportable. If you close your account, you have 30 days to export your data before it is permanently deleted.

Yes. Data is encrypted at rest (AES-256, Supabase's AWS infrastructure) and in transit (TLS). Connection tokens for third-party services (Gmail, QuickBooks, etc.) are also encrypted by SubmitX (AES-256-GCM). Card numbers are never stored by SubmitX: they are processed by Stripe (PCI DSS Level 1).

On your side: each company is isolated at the database level (Row-Level Security), and you choose each employee's access, module by module. Two-factor authentication (2FA) can be made mandatory for sensitive roles, and an audit log tracks changes. At SubmitX: access only for support, at your request. A person in charge of the protection of personal information is designated in accordance with Law 25.

Yes. Report any vulnerability to support@submitx.ca with the subject "Security". We acknowledge receipt, fix it as a priority and coordinate disclosure with you.