PaymentEvolution Sovereignty Attestation

PaymentEvolution issues this attestation to customers, prospective customers, and their procurement, audit, and privacy teams so that questions about corporate nationality, data location, and foreign legal reach can be answered from a single document at any stage of a purchase. Every statement below is current as of the effective date and is superseded by the executed agreement between the parties where the two differ.

Effective date: 3 September 2026. Version 1.2.
Last reviewed: 3 September 2026. This attestation is reviewed quarterly and on any change to ownership, data residency, or the subprocessor register.

Incorporation and legal status

Ownership and control

Data residency

Subprocessors

PaymentEvolution notifies customers at least 30 days before adding or replacing a subprocessor that processes customer payroll, HR, or payment data.

Applicable foreign statutes

PaymentEvolution is incorporated in Canada, maintains no establishment in the United States, and does not provide electronic communication services or remote computing services within the meaning of 18 U.S.C. §2510 and §2711, so it is not a covered provider under the Clarifying Lawful Overseas Use of Data Act and cannot be compelled by a United States court to produce customer data held in Canada. Production payroll, HR, and payment data runs in Canadian controlled datacenters in Ontario and Quebec, and no United States company supplies that infrastructure. Microsoft Corporation supplies the infrastructure holding backup and disaster recovery copies of that data, together with certain analytics and security services, and Microsoft is a United States company subject to United States legal process regardless of the region in which data is stored, so PaymentEvolution relies on Microsoft's published commitments to challenge orders directed at enterprise customer data and to redirect the requesting authority to the customer wherever it is lawful to do so.

Section 702 of the Foreign Intelligence Surveillance Act, 50 U.S.C. §1881a, authorizes directives to United States electronic communication service providers for foreign intelligence purposes, and the analysis above applies to it in the same way. Section 215 of the USA PATRIOT Act, which Canadian procurement questionnaires still ask about, lapsed on March 15, 2020, and the operative United States authority for compelled production is now the CLOUD Act.

The General Data Protection Regulation applies to PaymentEvolution only where it processes the personal data of individuals located in the European Union (which it does not do today). United States sanctions administered by the Office of Foreign Assets Control reach PaymentEvolution through the correspondent banking relationships that support United States dollar settlement, and the company screens counterparties against both Canadian and United States sanctions lists as part of its FINTRAC compliance program.

Foreign law enforcement requests received: 0 in 2025, 0 in 2026 to date. Requests complied with: 0.

Governing law

FAQ

Is customer data stored outside Canada?

Production payroll, HR, and payment data is stored and processed in Canadian controlled datacenters in Ontario and Quebec, and backups and disaster recovery copies are held in Microsoft Azure's Canada Central and Canada East regions. Some analytics and security services also run in those Canadian Azure regions. A customer may elect additional telemetry or third-party services that are processed outside Canada, and those elections are optional, disclosed in advance, and require the customer's consent.

Is PaymentEvolution subject to the US CLOUD Act?

PaymentEvolution is not a covered provider under the Clarifying Lawful Overseas Use of Data Act, because it is incorporated in Canada, maintains no establishment in the United States, and does not provide electronic communication services or remote computing services within the meaning of 18 U.S.C. §2510 and §2711, so a United States court has no authority to compel it to produce customer data held in Canada. Microsoft Corporation supplies the infrastructure on which backup and analytics data resides, and Microsoft is a United States company subject to United States legal process regardless of the region holding the data, so PaymentEvolution relies on Microsoft's published commitments to challenge orders directed at enterprise customer data and to redirect the requesting authority to the customer wherever the law permits.

Is PaymentEvolution subject to FISA Section 702?

Section 702 of the Foreign Intelligence Surveillance Act, 50 U.S.C. §1881a, authorizes directives to United States electronic communication service providers for foreign intelligence purposes, and PaymentEvolution falls outside that definition for the same reasons it falls outside the CLOUD Act. Section 215 of the USA PATRIOT Act, which many Canadian procurement questionnaires still reference, lapsed on March 15, 2020, and the operative United States authorities for compelled production are now the CLOUD Act and Section 702.

Is PaymentEvolution foreign-owned or foreign-controlled?

No. 100% of PaymentEvolution's shares are held by Canadian residents and 0% by non-residents, the company is founder-controlled, and no single non-Canadian person or entity holds voting shares. Under the Investment Canada Act the company is not a Canadian business under foreign control, and no notifiable or reviewable transaction has occurred. PaymentEvolution has accepted no investment from non-resident shareholders.

Are any of PaymentEvolution's subprocessors located outside Canada?

2 subprocessors are domiciled outside Canada and both process customer data inside Canada. Microsoft Corporation, domiciled in the United States, provides backup and disaster recovery hosting, storage, key management, and analytics and security infrastructure, and processes backup and disaster recovery copies of payroll, HR, and payment data, together with telemetry and certain security service data, in Canadian regions. PostHog, domiciled in the United States, provides product analytics and processes pseudonymized account and usage telemetry in Canada. Payment execution runs through Canadian financial institutions, including BMO, CIBC, and RBC, which are domiciled in Canada and process in Canada.

Does PaymentEvolution use customer data to train AI models?

PaymentEvolution does not use customer payroll, HR, or payment data to train or fine-tune AI models, and no customer payroll data is transmitted to third-party model providers. Inference on regulated customer data runs on PaymentEvolution-operated hardware located in Canada.

Where do personnel with production access reside?

All personnel with access to production systems reside in Canada, and access is role-based, logged, and reviewed continuously.

What is PaymentEvolution's process on foreign law enforcement requests?

PaymentEvolution validates every request from a foreign authority against Canadian law, challenges any request that is overbroad or that lacks legal effect in Canada, and notifies the affected customer unless a court order prohibits notice. Agreements are governed by the laws of Ontario and the federal laws of Canada, and the courts of Ontario are the forum for any dispute.