Data Processing & Storage
Where and how your data is hosted, processed, and protected
Last updated: 31 October 2025
This page describes where and how RadProcess stores and processes your business data. It supplements our Subscription Terms and Privacy Policy.
Data Location
Primary Infrastructure
RadProcess is hosted on enterprise-grade cloud infrastructure. Your data may be stored and processed in the following regions:
🇨🇦 Canada
Primary data center location. Most Canadian customers' data is stored here by default.
🇺🇸 United States
Secondary infrastructure for redundancy and performance optimization.
Data Residency Requests: If you require that your data be stored exclusively in Canada, please contact us before signing up. Canada-only data residency may be available for Enterprise plans and must be agreed to in writing.
Cloud Providers
We use the following trusted cloud service providers:
- Vercel: Web application hosting and edge network (used for website and application front-end)
- Database Hosting: Secure, encrypted database services with automatic backups
- Object Storage: For uploaded files, documents, and product images
Data Processing
What Data We Process
When you use RadProcess, we process the following categories of data:
Account & User Data
Organization name, user names, email addresses, roles, permissions
Business Data
Products, inventory records, suppliers, purchase orders, RFQs, customers, leads, opportunities, quotes, sales orders, shipments
Website Content
Integrated website pages, product listings, images, customer-facing content
Usage Data
Log data, feature usage, API calls, system events (for support, security, and service improvement)
Payment Information
Processed through Stripe (we do not store full credit card numbers)
How We Process Your Data
- Hosting & Storage: Storing your data in secure, encrypted databases
- Transmission: Transferring data between your browser and our servers using TLS encryption
- Computation: Running calculations, reports, analytics, and business logic
- Display: Rendering data in the user interface and on integrated websites
- Backups: Creating automated daily backups for disaster recovery
- Support: Accessing data when you request technical support (with appropriate permissions)
Data Encryption
Encryption in Transit
All data transmitted between your devices and RadProcess is encrypted using:
- TLS 1.3 (Transport Layer Security) - the latest industry standard
- Strong cipher suites with perfect forward secrecy
- HTTPS for all web traffic
Encryption at Rest
All data stored in our databases and file storage is encrypted using:
- AES-256 encryption (Advanced Encryption Standard with 256-bit keys)
- Encrypted database volumes
- Encrypted backups
- Secure key management with automatic rotation
Data Backups
Backup Schedule
We perform automated backups of all tenant data:
- Frequency: Daily automated backups
- Retention: Backups retained for 30 days
- Storage: Geo-redundant storage across multiple data centers
- Encryption: All backups are encrypted at rest
Disaster Recovery
In the event of a system failure or data loss:
- We can restore from the most recent backup (typically within 24 hours)
- Recovery Point Objective (RPO): Up to 24 hours of data
- Recovery Time Objective (RTO): Typically 2-8 hours depending on incident severity
Data Exports
During Active Subscription
While your subscription is active, you can export your data at any time:
- Via the App: Export individual entities (products, customers, orders, etc.) as CSV or JSON
- Via API: Programmatically export data using our REST API
- Full Export: Request a complete tenant export by contacting support
After Termination
If you cancel your subscription:
- Your access to the Service stops immediately
- We retain your data for 30 days to allow you to request an export
- You can request a final data export within this 30-day period (provided your account is not in arrears)
- After 30 days, we may permanently delete your data
Data Deletion
User-Initiated Deletion
You can delete individual records (products, customers, orders) at any time through the application. Deleted items:
- Are soft-deleted (moved to a "deleted" state) for 30 days in case of accidental deletion
- Can be restored within 30 days by contacting support
- Are permanently deleted after 30 days
Account Termination
When your subscription ends (by cancellation or non-payment):
- We retain your data for 30 days for potential export
- After 30 days, all tenant data is permanently deleted from production systems
- Backup copies may persist for up to 60 days total (for backup retention policy)
- After 60 days, all traces of your data are removed from our systems
Third-Party Sub-Processors
We use the following trusted third-party service providers to help us deliver RadProcess:
| Provider | Purpose | Location |
|---|---|---|
| Vercel | Web hosting, CDN | US, Canada |
| Stripe | Payment processing | US, Global |
| Email Provider | Transactional emails | US |
All sub-processors are contractually required to maintain appropriate security and privacy standards. We will update this list if we add new sub-processors.
Compliance & Certifications
RadProcess is designed to comply with:
- PIPEDA (Personal Information Protection and Electronic Documents Act) - Canada's federal privacy law
- GDPR (General Data Protection Regulation) - For EU customers, where applicable
- SOC 2 Type II - Currently in progress (expected completion 2025)
For more details on how we handle personal information, see our Privacy Policy.
Your Rights
Under Canadian privacy law (and GDPR if applicable), you have the right to:
- Access: Request a copy of your data
- Correction: Update inaccurate or incomplete data
- Deletion: Request deletion of your data (subject to legal retention requirements)
- Portability: Export your data in a machine-readable format
- Object: Object to certain processing activities
To exercise these rights, contact us at privacy@radext.com.
Questions about Data Processing?
RadExt Software Inc.Data Protection Officer
Vancouver, BC, Canada
Email: privacy@radext.com
General: info@radext.com