Who else touches getowed
Last updated: October 9, 2026
These are the companies that help run getowed: our sub-processors, meaning companies that handle information on our behalf. getowed has no field for a client’s name, so by design none of them is given one — with one limit, set out below. This page says which companies they are, what each one does, what it can see, and where it does it.
Our organization licence promises 30 days’ notice before we add another, by writing to each organization’s account owner. If your organization has not signed anything, write to hello@getowed.ca and we will tell you too, before we add a company to this list.
The companies
| Company | What it does | What it can see | Where |
|---|---|---|---|
| Railway Railway Corporation · data processing terms | Runs the site and the database | Everything the site stores | United States (Virginia) |
| Cloudflare Cloudflare, Inc. · data processing terms | Sits in front of the site | Every request as it passes through, including casework on its way to and from your browser. Private pages are never cached, so it keeps no copy of those pages | A worldwide network that includes a data centre in Toronto |
| Postmark AC PM, LLC, part of ActiveCampaign · data processing terms | Sends our email when HostPapa cannot (a backup) | The address written to, and what the message says | United States (main servers near Chicago) |
| Stripe Stripe Payments Canada, Ltd. · data processing terms | Takes payment from organizations on a paid plan | Billing details only, for an organization on a paid plan: its name, billing email and address, and the card, which Stripe keeps and getowed never sees. Never any casework | United States and other countries |
| HostPapa HostPapa, Inc., Burlington, Ontario · privacy policy | Runs our own mailboxes and sends our email | Mail sent to and from our getowed.ca addresses — including anything you write to us, and the email we send you | Canada (Toronto) |
That is the whole list. There is no advertising network, no analytics company, and no third-party script on any page.
Where it runs
The database is in the United States. We read the region off the Railway dashboard on 12 September 2026: it is US East, in Virginia, and Railway offers only four regions — Amsterdam, California, Singapore and Virginia. There is no Canadian one to move to.
Our mailboxes are a separate thing in a separate place. They are run by HostPapa on a server in Toronto, Canada, and their backups are kept on that same server. HostPapa confirmed both in writing on 13 September 2026.
If your organization is in Quebec and needs a privacy impact assessment before it can use us, write to us and we will answer its questions.
What none of them get
getowed is built with no place for a client’s name, date of birth, address or diagnosis. A case carries the file reference your organization chose, an optional client number that joins one person’s cases, a province, a stage, some dates and an amount. There is no field for more, and a check on every build refuses to add one. A few fields are free text, and no design can stop somebody typing a client’s name into one; we ask you not to.
How long each kind of information is kept is set out once, in our privacy policy.
How it is protected
Every connection to getowed is encrypted. A plain http address is sent on to https, and browsers are told to use nothing but https for a year.
No page loads code from another company. The site’s own security policy forbids it.
Pages you see after signing in are never kept in a cache — not by your browser and not by Cloudflare — so they are not left behind on a shared computer.
If information you hold with us is ever exposed, our licence promises to tell you as soon as we can and within 72 hours of confirming it.
We do not claim more than that. Whether the database is encrypted while it is stored depends on Railway, and we have not yet checked it; we hold no security certification.
Changes to this list
6 October 2026 — a correction, nothing added or removed. The Stripe row now says what Stripe sees for an organization on a paid plan, where it said billing was switched off.
5 October 2026 — a change of role, nothing added or removed. HostPapa, which already ran our mailboxes in Toronto, now also sends our email. Postmark now sends it only when HostPapa cannot, as a backup. The reason: HostPapa has no monthly limit, and the email you are waiting on, such as a sign-in link, should never be held by one.
17 September 2026 — corrections, nothing added or removed. Added the company behind each name, a link to its own terms, and where it does its work. Corrected two rows: Cloudflare can see casework as it passes through, which this page had denied, and Stripe holds nothing yet, because billing is not switched on. Postmark is operated by AC PM, LLC, part of ActiveCampaign, which bought it in 2022. Added how the service is protected.
12 September 2026 — a correction: HostPapa. HostPapa was missing from this page until 12 September 2026. It was not a new arrival — it has run our mail all along, and it is the company that holds anything you send to hello@getowed.ca. We had counted it as our own mailbox rather than as a company handling information for us, and that was wrong. Correcting a list is not the same as adding to it, so the 30 days’ notice our licence promises is not what was owed here — this sentence is.