Custodian, never owner

A Nation’s information belongs to that Nation. IRIS holds and processes it to run the platform on the Nation’s behalf, and a Nation may withdraw its material at any time. Where a Nation has claimed its record, decisions about that record — what is published, what is disclosed, to whom — are the Nation’s to make. The software and the platform’s own compiled reference data remain the operator’s.

The database and file storage run in Amazon’s Canadian region (ca-central-1). The code that reads them — including the code that decrypts sealed testimony — is pinned to Montreal, so processing happens on Canadian soil rather than defaulting to a US region. Outbound email sends from Canada as well. This covers what IRIS itself processes and stores; a message read at a mailbox hosted elsewhere arrives there regardless.

The complete list, not a representative sample:

• Supabase / Amazon Web Services — database, file storage and sign-in.
• Vercel — application hosting, pinned to Montreal.
• Amazon SES — outbound email.
• Mapbox — map tiles for the area a browser is viewing.
• OpenAI — where the assistant runs on the hosted path, document text and the question asked are sent to build the search index and compose an answer. IRIS also operates its own inference hardware in Canada.

There is no analytics vendor, no advertising network and no tracking script.

The Chief and Council read their own Nation’s private record. IRIS operators — the reviewers who confirm a claimant’s standing — see the claim they review and the platform’s audit data; they make no representational decision on a Nation’s behalf and cannot invoke withdrawal for it. Every operator grant and revocation is itself audited.

Withdrawal is a state transition, not a flag. When the Chief withdraws from an engagement, IRIS stops displaying what was disclosed inside the platform, pulls back in-platform reports and revokes pending invitations; the audit history remains. A report a partner already downloaded as a file cannot be recalled, and IRIS reports that honestly rather than implying it can.

A retention period for engagement recordings and sealed testimony has not yet been set; that decision belongs with the Nations whose material it is. Until it is set, nothing is deleted on a schedule, a community may request deletion of its material at any time, and withdrawal takes effect immediately.

Under Canadian federal privacy law you may ask what personal information IRIS holds about you, ask for it to be corrected, and withdraw consent. The operator’s address and telephone are on the Help page and in the privacy notice.