Privacy and security summary
A short summary for municipalities, heritage committees and organizations reviewing The Patina Record. The full Privacy Policy and Terms of Service govern.
What we hold
- Heritage records: public information from municipal registers, notices, council agendas and open data, each with its source and date. No owner names, mailing addresses or contact details are kept.
- Accounts: an email address, the alerts and lists a person sets up, and what they choose to save (research records, group membership). No passwords: sign-in is by emailed link.
- Payments: handled by Stripe. We never see or store card numbers.
Where it is stored and who processes it
| Service | What | Location |
|---|---|---|
| Supabase (on Amazon Web Services) | Database, accounts and sign-in, uploaded photos | Canada (Montréal, ca-central-1) |
| Vercel | Runs the website; pages pass through its servers | United States (Washington, D.C.), delivered through its network including Montréal |
| Resend | Sends alert and digest emails | United States |
| Stripe | Payments and invoices | Canada and United States |
| GitHub | Scheduled data updates; encrypted nightly backups kept 14 days | United States |
How it is protected
- All traffic is encrypted (HTTPS). The website reads the database through a read-only role.
- Row-level security in the database keeps each person to their own alerts, records and claims; new tables are tested with simulated users before release.
- Backups are encrypted (AES-256) before they leave the database.
- Page-view analytics are cookie-free and keep no personal data.
- An account and everything in it can be deleted by its owner at any time from the account page.
Notes for municipalities (MFIPPA)
- Heritage register information is public under the Ontario Heritage Act (s. 27). We republish it with its source and do not collect personal information from municipal records.
- Staff accounts hold only a work email and what the person saves. Municipalities that need personal information kept in Canada should note that the website runs on US servers and emails are sent from the US; the database is in Canada.
- We will sign a data-processing or confidentiality agreement on request.
Report a security issue
Email hello@thepatinarecord.ca. We reply within two business days.
Last reviewed October 2026.