Subprocessors
Version 9 · Last revised: July 21, 2026
This page lists every third party that processes Filemark customer data on our behalf, together with the region, role, status, and cross-border posture for each.
Core service subprocessors
These providers support Filemark’s production service. Their presence here does not mean every category of customer data is sent to every provider: the AI processing described below remains subject to client authorization and firm controls.
| Subprocessor | Purpose | Region | Cross-border? |
|---|---|---|---|
| Amazon Web Services | Cloud hosting, managed database, object storage, authentication, malware scanning of portal uploads, encrypted credential vault, and transactional email | Montreal, Canada (AWS ca-central-1) | No |
| Amazon Web Services — Bedrock | AI inference through Amazon Bedrock for clearly defined purposes recorded in each firm’s AI settings, subject to the per-client authorization and firm controls described under “Cross-border transfers” below. When AI is unavailable or not authorized, the corresponding deterministic or manual workflow remains available. Under the Bedrock commercial service Filemark uses, prompts and outputs are not shared with the foundation-model provider and are not used to train base models. | Canada and United States. Calls originate in Canada and may be processed in either country. | Yes |
| Stripe Canada | SaaS billing of CPA firms — subscriptions, invoices, and payments. Payment details are entered on Stripe-hosted pages and never touch Filemark servers. No client tax data is sent to Stripe. | United States (Canadian credit cards and pre-authorized debits supported) | Yes |
Opt-in subprocessors
A firm administrator enrolls these one at a time from the integrations page. No data flows until enrollment, and the connector can be revoked at any time.
| Subprocessor | Purpose | Region | Cross-border? |
|---|---|---|---|
| OneSpan Sign | E-signature for partner-binder release and engagement letters | Montreal, Canada | No |
| ISED Federal Corporations Registry | Federal corporation lookups (legal name, business number, registered office). No Filemark customer data is sent; lookups use only the corporation or business number. | Canada (Government of Canada) | No |
| Wolters Kluwer (CCH iFirm Web API) | Tax-software handoff push: T2 jacket and schedule cell values for the firm’s chosen client engagement | Canada (CCH iFirm Canadian deployment) | No |
| Xero (Accounting) | Read-only trial-balance, profit & loss, and balance-sheet pull from the firm’s connected Xero organisation. Granular read-only OAuth scopes only. | United States and Australia (firm chooses at Xero signup) | Yes |
| Microsoft (Graph — OneDrive / SharePoint) | Per-file fetch via Microsoft’s official OneDrive picker. Filemark cannot enumerate, browse, or list drives or folders. Only files the user explicitly picks are visible. Microsoft enforces this with the Files.SelectedOperations.Selected scope and per-file permission stamping. | Tenant-region dependent (firm’s Microsoft 365 tenant residency) | Depends on tenant |
Cross-border transfers
Filemark’s persistent application database, object storage, backups, and saved AI results are in Canada (AWS ca-central-1). AI inference may be processed in Canada or the United States as described above. Bedrock does not retain prompts or outputs; Filemark may log AI prompts and outputs in Canada on AWS under a 90-day retention policy. That processing requires the current versioned client authorization and is also subject to the firm’s master and purpose controls. The client may withdraw that authorization at any time, which disables all AI processing for that client. For an optional connector, the firm’s authorized administrator must enroll the connector and acknowledge any applicable transfer disclosure before data flows, and may revoke it at any time. Filemark has conducted a Quebec Law 25 § 17 assessment for each cross-border transfer; a summary is available on request to privacy@filemark.ca.
Notification of changes
Material changes to this page — including the addition of a new active subprocessor, the removal of a subprocessor, or a change in a subprocessor’s data residency — are published here and announced by email to the firm’s administrators at least 30 days before they take effect. The version number above changes with each material edit.
Contact
Questions about a specific subprocessor, requests for the Law 25 § 17 transfer assessment, or DPA requests: privacy@filemark.ca.