Data residency attestation

All customer application data, databases, and server configurations hosted through MapleDeploy are stored exclusively in Toronto, Canada on infrastructure provided by LunaNode Hosting Inc., a privately held Canadian corporation headquartered in Toronto, Ontario.

Infrastructure provider

Sub-processors

MapleDeploy uses a limited set of third-party service providers. A current list is maintained on our sub-processors page.

Jurisdictional protections

• PIPEDA compliant: MapleDeploy operates under the Personal Information Protection and Electronic Documents Act (Canada's federal privacy law). As a commercial organization engaged in interprovincial and international activity from Ontario, PIPEDA applies directly to our operations.
• Outside US CLOUD Act: Customer application data, databases, and server configurations are hosted by LunaNode Hosting Inc., a Canadian corporation not directly subject to US CLOUD Act jurisdiction. Certain ancillary services (payment processing, uptime monitoring) involve US-based providers that may be subject to US jurisdiction for the limited data they handle. See our sub-processors page for details.
• GDPR adequacy: Canada holds an EU adequacy decision (Decision 2002/2/EC, carried forward under GDPR Article 45(9)) for commercial data processing under PIPEDA. This decision, originally made under the predecessor Data Protection Directive, is subject to periodic review by the European Commission.

Data controls

• Customer data is logically and physically isolated (dedicated VM per customer)
• Data at rest is stored on encrypted storage provided by LunaNode
• Data in transit is encrypted via TLS
• Customer-managed access credentials (MapleDeploy does not store Coolify admin passwords)
• Automated backups with 7-day retention
• Pre-deletion snapshots retained for 30 days before permanent deletion

Data portability

Customers retain full administrative access to their Coolify instance and can export all data (application configurations, database dumps, files) at any time. MapleDeploy does not restrict data export.

Quebec Law 25

For customers subject to Quebec's Law 25 (Act respecting the protection of personal information in the private sector, as amended):

• All customer application data is hosted exclusively in Canada (Toronto). MapleDeploy has conducted a privacy impact assessment (s. 17) for the interprovincial transfer and maintains the corresponding written agreement in its internal compliance records.
• Payment data is processed by Stripe in the United States. MapleDeploy has conducted a privacy impact assessment for this transfer, covering Stripe's PCI DSS Level 1 certification, DPA, and the limited scope of data transferred. Personal information may be communicated to service providers located in the United States for payment processing and uptime monitoring purposes.
• MapleDeploy has designated a person responsible for the protection of personal information as required by Law 25. Contact: hello@mapledeploy.ca.
• MapleDeploy maintains a privacy incident registry, reports qualifying incidents (those presenting a risk of serious injury) to the CAI and affected individuals with diligence, conducts privacy impact assessments before adding sub-processors, and applies privacy by default in system design.
• Customers remain responsible for their own privacy policies, consent management, privacy impact assessments, privacy officer designation, and incident response procedures for their own applications.

Attestation

I attest that the information provided on this page is accurate to the best of my knowledge. MapleDeploy monitors its infrastructure provider's corporate structure and jurisdiction on a best-effort basis and will notify customers of material changes.

Ross Hill Founder, MapleDeploy

This page is provided for informational purposes and does not constitute legal advice. Customers should consult qualified legal counsel regarding their specific compliance obligations.

Last updated March 21, 2026