DPIA — SendGrid (transactional email)

Twilio SendGrid is our transactional email delivery service (data-subject request acknowledgements, notifications, reports, alerts). Outbound emails flow through SendGrid's infrastructure for delivery.

• Recipient email address (tenant or data subject)
• Email content (may include a call summary: name, number, nature of request)
• Send metadata (timestamp, delivery status)

Email routing transits SendGrid's infrastructure (email carrier). No application data is retained at rest at SendGrid beyond short-term delivery activity logs; persistent storage remains in Canada (Montréal).

• SendGrid (Twilio) is bound by a mature DPA offering safeguards equivalent to Loi 25
• The email-carrier role is intrinsic to sending notifications — sending an email necessarily transits an email provider
• Categories limited to what's strictly necessary for delivery
• SendGrid does NOT train AI models on customer content

Overall: LOW. Industry-standard for transactional email.

• Unauthorized staff access: very low (SOC 2 Type II audited)
• AI training on data: negligible (contractual prohibition)
• US subpoena: low (transparency reports available)
• Datacenter breach: very low (SOC 2, ISO 27001)

• Email activity logs: short-term (delivery/diagnostics)
• Email content: not persistently retained beyond delivery

SendGrid is an industry-standard email carrier. Its DPA provides protection equivalent to Loi 25 requirements. Risk is LOW. Transfer is justified.

DPA reference: twilio.com/legal/data-protection-addendum