Where your data goes, and what leaves Quebec
Echo Support runs on a server in Beauharnois, Quebec: the applications, the database and the files stay there. But the text of every conversation handled by the AI is sent to OpenRouter, in the United States, which routes it to the provider running the language model. Sensitive information is not masked before that. This page names every provider, what each one receives, and where it is.
Facts verified on . Every statement on this page points to something we publish or run; where something does not exist yet, this page says so.
What stays in Quebec
- The applications and the database: a server hosted by OVH Hosting Inc. in Beauharnois, Quebec.
- The files: attachments and knowledge-base documents live on that same server, on a local volume. No S3, no external storage service.
- Transactional email: a self-hosted Mailcow on the same machine.
- Conversation history: stored in that database and nowhere else.
What does not stay
Four providers receive data, and none of them is in Quebec. This is the list our privacy policy already publishes, with what each one actually gets.
| Provider | What it receives | Where |
|---|---|---|
| OpenRouter, Inc. | The text of the last 12 messages of a conversation handled by the AI, plus extracts from your knowledge base when the assistant searches it. Also the documents you upload, for text extraction. | United States — and it routes to the provider running the model, whose country varies. |
| Cohere Inc. | The text of documents and help articles you index, and every search query the assistant issues. | Canadian company; the place of computation is not guaranteed to be Canada. |
| Stripe | Billing data. Never conversation content. | United States. |
| Sentry | Error reports from the applications. | European Union. |
Sensitive information is not masked before it is sent to the model. That is why our terms ask you not to put health data, social insurance numbers or banking details into Echo Support.
What the AI never receives
- The visitor’s name and email. The system prompt contains no identity, and the agent thread is created under your organisation, not under the visitor.
- Files attached by a visitor. Only the file name enters the prompt — the image or PDF itself is never sent to the model.
- Anything at all, if you switch the assistant off: your team then answers every conversation itself.
Our role under Quebec Law 25
You remain the person responsible for the personal information your customers give you. Groupe Echo Inc. acts as your mandataire (processor) within the meaning of section 18.3: we use that information only to provide the service, we keep it confidential, we notify you of any confidentiality incident, and we destroy or return it on request. The full clause is in section 11 of our terms of use.
We do not claim to be “Law 25 certified”. No such certification exists, and the privacy impact assessment that a transfer outside Quebec calls for has not been carried out. What we can do is tell you exactly where the data goes — which is what this page is for, and what such an assessment starts from.
The five questions to ask any supplier
Compliance guides converge on the same five. Here are ours, answered.
| Question | Our answer |
|---|---|
| Where is the data hosted? | Beauharnois, Quebec, for everything we store. |
| Does anything leave the country? | Yes: conversation text handled by the AI, and indexed documents. See the table above. |
| Is it used to train models? | We do not train any model. What the providers do with what they receive is governed by their own terms. |
| How long is it kept? | For as long as the account exists. Conversation history has a per-plan limit — but see the honest note below. |
| Do you accept processor status? | Yes, in writing, in section 11 of the terms. |
What does not exist yet
A page like this is worth nothing if it only lists what works.
- There is no deletion screen in the dashboard. To have a visitor’s data erased, write to vie-privee@echo-group.ca.
- There is no self-serve export either: we prepare a copy on request, at the same address.
- Automatic purging of expired conversations is built but not switched on in production. Until it is, history is not deleted on its own — we would rather write that here than let you assume otherwise.
- We do not document encryption at rest for the database, because we have not established it.
Ask us
Anything unclear, or anything you need in writing for your own assessment: vie-privee@echo-group.ca. Our full privacy policy goes further.