All customer application data, databases, and server configurations hosted through MapleDeploy are stored exclusively in Toronto, Canada on infrastructure provided by LunaNode Hosting Inc., a privately held Canadian corporation incorporated in British Columbia that operates its own infrastructure in a Toronto data center.
Infrastructure provider
| Attribute | Detail |
|---|---|
| Provider | LunaNode Hosting Inc. |
| Corporate jurisdiction | British Columbia, Canada (Corporate Registry #BC0997033) |
| Data center location | Toronto, Canada |
| Foreign ownership | None (privately held, Canadian-owned) |
Sub-processors
MapleDeploy uses a limited set of third-party service providers. A current list is maintained on our sub-processors page.
Jurisdictional protections
- PIPEDA compliant: MapleDeploy operates under the Personal Information Protection and Electronic Documents Act (Canada's federal privacy law). As a commercial organization engaged in interprovincial and international activity from Ontario, PIPEDA applies directly to our operations.
- Outside US CLOUD Act: Customer application data, databases, and server configurations are hosted by LunaNode Hosting Inc., a Canadian corporation not directly subject to US CLOUD Act jurisdiction. Some ancillary services involve US-based providers that may be subject to US jurisdiction for the limited data they handle. Our sub-processors page is the current list: it names every provider, what it handles, and where.
- GDPR adequacy: Canada holds an EU adequacy decision (Decision 2002/2/EC, carried forward under GDPR Article 45(9)) for commercial data processing under PIPEDA. This decision, originally made under the predecessor Data Protection Directive, is subject to periodic review by the European Commission.
Data controls
- Customer data is logically and physically isolated (dedicated VM per customer)
- Data in transit is encrypted via TLS
- Customer-managed access credentials (MapleDeploy does not store Coolify admin passwords)
- Automated weekly VM snapshots, with the two most recent retained
- Pre-deletion snapshots retained for 30 days before permanent deletion
Data portability
Customers retain full administrative access to their Coolify instance and can export all data (application configurations, database dumps, files) at any time. MapleDeploy does not restrict data export.
Quebec Law 25
For customers subject to Quebec's Law 25 (Act respecting the protection of personal information in the private sector, as amended):
- All customer application data is hosted exclusively in Canada (Toronto). MapleDeploy has conducted a privacy impact assessment (s. 17) for the interprovincial transfer to its infrastructure provider, and reviews it annually.
- Payment data is processed by Stripe in the United States. MapleDeploy has conducted a privacy impact assessment for this transfer, covering Stripe's PCI DSS Level 1 certification, DPA, and the limited scope of data transferred. Personal information may also be communicated to other service providers located in the United States. The sub-processors page names each of them, including the sign-in providers you can choose to use and can avoid by signing in with a password or a passkey.
- MapleDeploy has designated a person responsible for the protection of personal information as required by Law 25. Contact: hello@mapledeploy.ca.
- MapleDeploy maintains a privacy incident registry, reports qualifying incidents (those presenting a risk of serious injury) to the CAI and affected individuals with diligence, conducts privacy impact assessments for cross-border transfers of personal information, and applies privacy by default in system design.
- Customers remain responsible for their own privacy policies, consent management, privacy impact assessments, privacy officer designation, and incident response procedures for their own applications.
Attestation
I attest that the information provided on this page is accurate to the best of my knowledge. MapleDeploy monitors its infrastructure provider's corporate structure and jurisdiction on a best-effort basis and will notify customers of material changes.
Ross Hill Founder, MapleDeploy
This page is provided for informational purposes and does not constitute legal advice. Customers should consult qualified legal counsel regarding their specific compliance obligations.