Steller is built and operated by a Canadian company. Customer account data (user accounts, organization settings, authentication) is stored and processed on servers in Toronto, Canada. The permit data Steller analyzes is public municipal open data sourced from city open-data portals; it contains no personal information and is processed in a data warehouse. For BC municipalities operating under the Freedom of Information and Protection of Privacy Act (FOIPPA), the account data hosting location supports your s.69(5) Privacy Impact Assessment obligations. For current, contract-grade data-processing details, request our Data Processing Addendum at hello@getsteller.ca.
Encryption
All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Database backups are encrypted with the same standard.
Access controls
Access requires authentication via JWT tokens (72-hour expiry). Passwords are hashed using bcrypt with SHA-256 pre-stretching. Login attempts are rate-limited and blocked after 10 failures in 10 minutes.
Subprocessors
Steller uses the following third-party services that may process data on our behalf:
Fly.io (Toronto, Canada): application hosting and account database
Google BigQuery: public permit open-data warehouse (contains no personal information)
Cloudflare (Canadian edge): CDN and DDoS protection
Resend: transactional email (verification and password reset only)
No other third parties have access to municipal data.
Incident response
In the event of a data breach, affected customers will be notified within 72 hours as required under PIPEDA. We maintain an incident response plan reviewed annually.
Security reviews
We conduct internal security reviews on each major release.