Private by design. In your region.
Privacy isn't a tier in Nestree. It's the foundation. Here's exactly how your data is stored, isolated, and protected.
Your data lives in your region
- Hosted in Canada (Supabase, AWS ca-central-1). Canada holds EU adequacy, so it is a lawful home for EU data too.
- Built GDPR-first from the very first database table, not retrofitted.
- Every workspace is isolated at the database level with Postgres row-level security (RLS), so one tenant can never read another's data.
Your data is yours
- Full export of your workspace data, any time, in open formats (CSV + JSON).
- One-click GDPR erasure with a soft/hard cascade and an audit log, so the right to be forgotten is actually implemented.
- Granular marketing consent is enforced in the database; only consented, non-suppressed contacts are ever emailed.
AI you can trust
- Assistive, never autonomous: AI drafts and suggests, a human confirms. It never sends or changes records on its own.
- Every AI touch is labeled (EU AI Act Art. 50) and logged, with a human-in-the-loop record (GDPR Art. 22).
- Usage is capped per workspace with a live cost meter, with no runaway spend and no surprise bills.
- Your CRM data is never used to train anyone's model.
Security practices
- Encryption in transit (TLS) and at rest, on managed Postgres infrastructure.
- Authentication and session management via Supabase Auth; secrets are server-only and never reach the browser.
- Least-privilege access: the app runs RLS-scoped; bypass paths are explicit, reviewed, and audited.
Sub-processors
The third parties that process data to run Nestree. We keep this list current and update it before adding a new one.
| Provider | Purpose | Region |
|---|---|---|
| Supabase | Managed Postgres database, authentication, and platform services | Canada, ca-central-1 |
| Vercel | Application hosting, deployment, edge delivery, and web analytics | Global edge, United States control plane |
| Anthropic | Claude inference for assistive AI features selected by users | United States |
| Resend | Transactional and campaign email delivery when email features are enabled | United States |
Responsible disclosure
Found a security or privacy issue? We want to hear from you. Email privacy@nestdigital.ca with the details and we'll respond promptly. Please give us a reasonable window to remediate before any public disclosure.