Stiple Sub-Processor List
This page lists the third-party service providers ("sub-processors") that Stiple Inc. engages to process data on behalf of Stiple Labs and Mapdesk, what each one handles, which product it applies to, and where the data is located. It is referenced by, and read together with, the Stiple Privacy Policy (stiple.ca/legal/privacy, Section 5).
- Document
- Sub-Processor List
- Effective date
- 2026-05-29
- Last updated
- 2026-05-29
- Published at
- stiple.ca/legal/sub-processors
- Applies to
- Stiple Labs · Mapdesk
01Current Sub-Processors
The table below sets out our current sub-processors. Each receives only the data necessary to perform its function, is bound by a Data Processing Agreement with Stiple, and may not use the data for its own purposes. Substantive personal data — your survey, project, and file data — is stored in Canada; the only cross-border (United States) processing is for authentication and profile-photo delivery, and for payment processing, as noted below.
| Sub-processor | Purpose | Applies to | Data location |
|---|---|---|---|
| WorkOS | Identity / authentication and profile-photo content-delivery network (CDN) | Stiple Labs + Mapdesk | United States |
| Backblaze B2 | Object storage for survey / project data, images, and files | Stiple Labs + Mapdesk | Canada (Toronto) |
| Amazon Web Services (AWS) | Cloud infrastructure and compute (backend) | Stiple Labs + Mapdesk backend | Canada (ca-central-1, Montreal) |
| Stripe | Payment processing | Stiple Labs only1 | United States |
1.Mapdesk is free and has no in-app purchases; payments and subscriptions are handled entirely through Stiple Labs, so Stripe does not apply to Mapdesk.
Google Play Services Location is a bundled Android system component used by Mapdesk on Android devices. It runs on-device to provide location to the app and is not a data-transmitting sub-processor of Stiple; Stiple does not send your survey, project, or personal data to it.
02How We Manage Changes
Effective date. This list is effective as of May 29, 2026. It supersedes any sub-processor information previously enumerated inside the Stiple Privacy Policy.
Material changes. When we add, remove, or materially change a sub-processor, we will update this page and post notice of the change here. Where applicable law requires it, we will also provide notice through other channels (for example, by email or a notice on the platform). Continued use of the Services after a change takes effect reflects your awareness of the then-current sub-processor list.
Why this list is maintained separately. Keeping the sub-processor list as a separate, dated document lets us keep it accurate as vendors change, without re-issuing the entire Privacy Policy each time. Changes to this list are governed by this page rather than by the Privacy Policy's material-change notification cycle.
03Data Residency Summary
- Substantive personal data stays in Canada — survey/project data, images, and files are stored on Backblaze B2 in Toronto; backend compute runs on AWS ca-central-1 (Montreal).
- The only cross-border (U.S.) processing of personal information is authentication and profile-photo delivery via WorkOS, and payment processing via Stripe (Stiple Labs only). Both are governed by Data Processing Agreements with appropriate contractual safeguards.
- Foreign government access. Where Stiple receives a foreign government request to access your data, we will notify you promptly unless we are legally prohibited from doing so.