Data processing summary

Operational summary for MSB vendor review — not a DPA. Full DPA provided at LOI.

Scope

Workflow and API layer for program intake and evidence export.

Data we process

Program intake: legal entity name, contact email, corridor, consent
RPAA checklist responses and uploaded documents (PDF/images)
Ops notes, status changes, TF-###### program ID identifiers
Partner slug metadata for branded intake (Partner Lite)

Where data lives

Application database on hosted infrastructure (region per deploy — confirm in DPA)
Document files on application storage (encrypted volume at deploy)
Optional Telegram channel alerts (metadata only — not full doc content)

Subprocessors (pilot phase)

Cloud hosting provider (region: Canada or US per deploy — confirm in DPA)
Telegram (ops notifications, if enabled)
Email provider (optional, when SMTP configured)

Retention & access

Retention per pilot SOW. Admin access via token; partner API scoped by X-Partner-Token. Export: CSV and HTML compliance report for your audit folder.

Security

HTTPS required in production. Readiness status is available at /api/readiness. Pilot engagements use counsel-reviewed DPA.

Incident contact

security@trustfield.ca — acknowledge within 24 business hours (update in signed DPA).

Vendor brief (PDF)

Begin in sandbox — scale through published programs

Self-serve signup and the full API loop are available at no fee. Apply for CAD 4,000 Discovery or an Integration Program when production scope is clear. Your MSB remains settlement party of record.

Start free in sandbox MSB program walkthrough

Questions? Contact us →

TrustField