Where your data goes, and what leaves Quebec
Echo Support runs on a server in Beauharnois, Quebec: the applications, the database and the files stay there. But the text of every conversation handled by the AI is sent to OpenRouter, in the United States, which routes it to the provider running the language model. Sensitive information is not masked before that. This page names every provider, what each one receives, and where it is.
Facts verified on . Every statement on this page points to something we publish or run; where something does not exist yet, this page says so.
What stays in Quebec
- The applications and the database: a server hosted by OVH Hosting Inc. in Beauharnois, Quebec.
- The files: attachments and knowledge-base documents live on that same server, on a local volume, with no S3 and no external storage service. Only the encrypted backup leaves the server.
- Transactional email: a self-hosted Mailcow on the same machine.
- Conversation history: stored in that database. Only its encrypted backup leaves (see GitHub below).
What does not stay
Six providers of the service receive data, and none of them is in Quebec. This is the list our privacy policy publishes for the service, with what each one actually gets. The echo-group.ca website is a separate scope: for a visitor who came through one of our ads, it may load the Google Ads tag, described on our Ads and cookies page.
| Provider | What it receives | Where |
|---|---|---|
| OpenRouter, Inc. | The text of the last 12 messages of a conversation handled by the AI, plus extracts from your knowledge base when the assistant searches it; the documents you upload, for text extraction. On paid plans, also what your team asks the AI for itself: rewording a draft or suggesting replies to it, the frequent-questions analysis (visitor messages from up to 100 conversations, 10 per conversation), translating a help article. And each month, the tags of conversations handed over to a human. | United States — and it routes to the provider running the model: DeepInfra (United States or Canada) or, failing that, Microsoft Azure (United States). |
| Cohere Inc. | The text of documents and help articles you index, every search query the assistant issues and, on paid plans, a summary of each resolved conversation (at most 4,000 characters; email addresses, phone numbers, card numbers, social insurance numbers and IBANs are masked automatically when recognised). | Canadian company; the place of computation is not guaranteed to be Canada. |
| Stripe | Billing data. Never conversation content. | United States. |
| Google LLC | Your sign-in request, if you choose “Sign in with Google”: Google then knows you are signing in to Echo. | United States. |
| Sentry | Dashboard error reports and, when an error occurs, a recording of the session it happened in, with text, input fields and media masked; your IP address. | European Union. |
| GitHub, Inc. | The daily backup of the database, files and email, encrypted before it is sent. The key stays with us: GitHub cannot read it. | United States. |
Sensitive information is not masked before it is sent to the model (only the summary sent to Cohere is). That is why our terms ask you not to put health data, social insurance numbers or banking details into Echo Support.
What the AI does not receive
- The name and email the visitor enters in the widget. The system prompt contains no identity, the agent thread is created under your organisation, not under the visitor, and neither suggestions nor rewording pass them on. The one exception is what the visitor writes in a message themselves, such as the order email a Shopify store asks for to find an order.
- Files attached by a visitor. Only the file name enters the prompt — the image or PDF itself is never sent to the model.
- Your visitors’ messages, if you switch the assistant off: your team then answers every conversation itself. What your team asks the AI for itself (rewording, suggestions, frequent-questions analysis) still goes out, and Cohere still receives the masked summary of resolved conversations.
Our role under Quebec Law 25
You remain the person responsible for the personal information your customers give you. Groupe Echo Inc. acts as your mandataire (processor) within the meaning of section 18.3: we use that information only to provide the service, we keep it confidential, we notify you of any confidentiality incident, and we destroy or return it on request. The full clause is in section 11 of our terms of use.
Our support team may access your dashboard without a request from you. You then see it live, with the pages opened and the changes made, and every access is recorded (section 11 of our terms of use).
We do not claim to be “Law 25 certified”. No such certification exists, and the privacy impact assessment that a transfer outside Quebec calls for has not been carried out. What we can do is tell you exactly where the data goes — which is what this page is for, and what such an assessment starts from.
The five questions to ask any supplier
Compliance guides converge on the same five. Here are ours, answered.
| Question | Our answer |
|---|---|
| Where is the data hosted? | Beauharnois, Quebec, for everything we store. |
| Does anything leave the country? | Yes: conversation text handled by the AI, indexed documents, the masked summary of resolved conversations, and an encrypted backup. See the table above. |
| Is it used to train models? | We do not train any model. For the language model, each request requires a provider that neither retains it nor uses it for training, according to the data policies OpenRouter publishes. Otherwise, what the providers do with what they receive is governed by their own terms. |
| How long is it kept? | For as long as the account exists. Conversation history has a per-plan limit: every night, conversations older than your plan allows are deleted (automatic purging switched on in production on September 28, 2026). |
| Do you accept processor status? | Yes, in writing, in section 11 of the terms. |
What does not exist yet
A page like this is worth nothing if it only lists what works.
- No screen erases everything about a visitor in one go. You can delete a conversation, with everything attached to it, or a contact record; for the rest, write to vie-privee@echo-group.ca.
- There is no self-serve export either: we prepare a copy on request, at the same address.
- We do not document encryption at rest for the database, because we have not established it. Only the backups are encrypted.
Ask us
Anything unclear, or anything you need in writing for your own assessment: vie-privee@echo-group.ca. Our full privacy policy goes further.