Where data lives

Stored in Canada

Your users’ data is stored in Canada: the database and cache are in Montréal, and sign-in emails are sent through AWS in Montréal (ca-central-1). That covers users, profiles, sessions, passkeys, organizations, sign-in history and abuse data.

Processed on US-hosted infrastructure

Requests are processed on US-hosted infrastructure (Railway, US East), so your users’ data is handled there while a request is being served. HonkIO Auth runs on the same hosting as the rest of HonkIO, with no separate Canadian-hosted service. So we say the data is stored in Canada, and not that it never leaves Canada.

Cloudflare and other providers

Secure connections to your sign-in hostname end at Cloudflare, which issues its certificate and forwards traffic to HonkIO. Cloudflare acts as a processor under its data processing agreement: it handles the traffic and doesn’t store it. Sign-in texts go through the carrier.

HonkIO’s providers, Railway, Supabase, Upstash, AWS, Cloudflare and the carrier, are US-owned companies; HonkIO doesn’t claim Canadian-owned infrastructure. No third-party bot check is used, so visitors’ details don’t go to one. The privacy policy lists every provider.

Abuse data

IP addresses, network data, device cookies and risk scores are stored in Canada with everything else, kept for 90 days, and then deleted or reduced to aggregate counts (Abuse protection).

Your privacy terms

Your own privacy terms govern your users’ data; HonkIO processes it on your behalf. The “Secured by HonkIO” footer of every sign-in page links to a short page saying where data is stored and processed, which links in turn to HonkIO’s privacy policy. You can export your users at any time (Export).