Sub-processors

Every third party Kaza hands data to, what each one actually sees, and where it sits. If a company is not on this list, it does not receive your data.

Last updated 28 July 2026

The list

Cloudflare

Runs the whole platform, the app, every company database, uploaded documents, cache.

What it sees:: Everything in your company's database, including applicant details and uploaded documents.
Where:: Cloudflare's global network. Not guaranteed to be Canada.

Resend

Delivers email Kaza sends: enquiry replies, confirmations, receipts, notices.

What it sees:: The recipient's email address and the content of the message.
Where:: United States.

Photon (Komoot)

Suggests a street address as someone types, for provinces whose address data is not held locally.

What it sees:: The partial address being typed. Never a name, and nothing else on the form.
Where:: Germany.

Nominatim (OpenStreetMap)

Turns a property's address into a map point, and catches a building filed under the wrong province.

What it sees:: A property address entered by your staff. No applicant or resident information.
Where:: OpenStreetMap Foundation infrastructure, Europe.

Helcim

Bills your company for Kaza itself. Nothing to do with rent.

What it sees:: Your billing contact and door count. Card and banking details go to Helcim directly and never reach Kaza.
Where:: Canada (Calgary).

Rotessa

Not enabled

Pre-authorised debit, if and when a company connects its own Rotessa account. Kaza never holds the funds.

What it sees:: Nothing today.
Where:: Canada.

What is NOT on the list, deliberately

No third-party analytics.No Google Analytics, no Plausible, no product-analytics SDK. The one count that exists is our own: Kaza’s marketing pages report the page and the referring site, cookie-free, to our operator’s own counting service, and no company’s site and no signed-in page reports anything.
No advertising or tracking network, and no third-party chat widget.
No outside AI service.The writing assistance runs on Cloudflare’s own network through a platform binding, on your company’s own data. Nothing is sent to an external model provider and nothing is used to train anything.

This is why Kaza has no cookie banner: there are no non-essential cookies to ask you about. The only cookie is the one that keeps you signed in.

Data outside Canada

Canadian law does not require that this data stay in Canada, and Kaza does not promise that it does. What the law does require is that you be told, so: some of the services above hold or move data outside Canada, and while it is there it is reachable by the courts and authorities of those countries.

Your company’s own database is a separate database, not a shared table with your name in a column, and you can take a complete copy of it as ordinary SQLite whenever you ask.

When this list changes

We tell account holders before a new sub-processor starts receiving data, not after, so that you have time to object or leave. The date at the top of this page is the date it was last checked against what the software actually does.