Where your data lives
You are bound by professional secrecy. So you have the right to know exactly who touches your data, where, and to do what. Here is the complete list — not a summary.
| Provider | Role | Incorporated in | Hosting | Data handled |
|---|---|---|---|---|
| Supabase | Database, authentication and document storage | United States | Canada — Montreal (ca-central-1) | Matters, contacts, time, invoices, documents, audit log |
| Vercel | Application hosting and audience measurement on the public pages | United States | Canada — Montreal (yul1) | No firm data retained: processing in transit only. Added to that is the aggregate page-view count for the public site, with no cookie and no identifier, and never on the pages behind sign-in |
| Sign-in with a Google account, if you choose that route | United States | United States | Your email address and your name, at the moment you sign in. No matter content. Signing in with a password avoids this provider entirely | |
| Microsoft | Sign-in with a Microsoft account, if you choose that route | United States | United States | Your email address and your name, at the moment you sign in. No matter content. Signing in with a password avoids this provider entirely |
| Amazon Web Services (SES) | Sending transactional email | United States | Canada — Montreal (ca-central-1) | Email addresses, subjects and links. No matter content |
| Amazon Web Services (Textract and Lambda) | Reading scanned documents and previewing Word documents | United States | Canada — Montreal (ca-central-1) | The contents of the document being processed, for the duration of processing only — never your name, your client’s name, or the matter name. The working copy is deleted by the next day at the latest |
| Amazon Web Services (Bedrock) | AI matter summary — on by default, one click to turn off | United States | Canada — Montreal (ca-central-1) | The text of the summarized matter’s documents, for the duration of the answer only. Your client’s and the parties’ names are replaced by labels before sending. The provider keeps nothing and has no right to train a model with it. Nothing goes out until someone REQUESTS a summary; a partner can turn the feature off in one click |
| Portage CyberTech / Notarius (ConsignO) | Certified electronic signature — only if your firm connects its account | Canada — Quebec | Canada | The PDF to be signed, plus the signer’s name, email and mobile number — nothing else from the matter. Nothing leaves until someone REQUESTS a signature, and the feature does not exist until a partner connects the firm’s own Notarius account, under its own agreement and its own bill |
| Stripe | Billing your Dossio subscription | United States | United States | Billing and payment details. No matter data |
| Sentry | Detecting application errors | United States | United States or European Union | Technical traces only, with aggressive scrubbing. No client name and no matter content |
The American CLOUD Act , said plainly
Supabase, Vercel, Amazon, Google, Microsoft, Stripe and Sentry are American companies. Even when their servers sit in Montreal, they remain subject to the CLOUD Act. That is true of very nearly every cloud legal software offered in Quebec, and we would rather write it down than leave it unsaid. Our intent is to move storage to a non-American provider hosted in Quebec as we grow.
What we do not do
We do not sell or share your data. We do not use it to train any model. No Dossio employee reads the contents of your matters, except at your written request and for the duration of a support intervention. We do read activity counts per firm — how many matters opened, how many invoices issued, when last — so we know which features are used and which are not. Those are numbers drawn from your own audit log, the one you consult yourself: never a matter number, never the contents of an entry, never the name of the person who performed the act.
Your data belongs to you
You can obtain all of your matters, contacts, time entries, invoices and documents at any time, in an open format, with no exit fee and without having to justify yourself. Until self-serve export is available in your account settings, it happens on written request and we deliver it within 15 days — see the terms of use.
Last updated: . Dossio is built to the Regulation respecting accounting and standards of professional practice of advocates (CQLR, c. B-1, r. 5). The Barreau du Québec certifies no software.
See also our privacy policy.