Security and trust
You are trusting us with your clients' information. This page explains how we handle it, how we test what we build, and what our systems will never do.
How we handle your data
- Before we build anything, you get a one-page data map: what data the system touches, where each step is processed, how long anything is kept, and who can access it.
- We collect and keep only what the workflow needs. Source documents are deleted after the retention period we agree with you.
- Your data is never used to train models for anyone else, and never to train one for you without a written agreement.
- Access is through dedicated accounts with the minimum permissions needed. It is removed the day an engagement ends.
Where your data is processed
Canada-first
DefaultThe application, database and storage sit in a Canadian cloud region. The AI model is chosen to fit your rules. If any step uses a provider outside Canada, the data map says so in writing.
Canada-only
On requestDedicated Canadian model capacity, or open-weight models hosted in Canada, for work that cannot leave the country.
The honest line
Not every model is available with processing in Canada. We say which option each part of your system uses before we build it, and we never claim your data stays in Canada unless it does.
How we test before launch
- 01
A locked test set
Every system is built against a locked set of your own past files or calls, with the correct answers checked by your staff.
- 02
A pass mark agreed first
Launch requires a pass mark agreed in writing before we start, not after.
- 03
Shadow mode
Where more is at stake, the system first runs beside your team with no effect on the work, and its output is compared with theirs.
- 04
Assisted launch
For those kinds of work a person approves each output, and a kind of work is automated only once its results hold.
- 05
Re-tested on every change
Every model or configuration change is run against the same test set before release.
Human oversight, and what our systems will never do
Never
- Bind insurance coverage, or give coverage advice
- Give legal or medical advice
- File, send or serve documents without a professional's review
- Make AI calls to anyone who has not agreed to receive them
- Take card numbers by voice
- Act below its confidence threshold without a person
Always
- Log every automated action with its input and model version
- Give you a way to pause the system instantly
Security practices
Encryption in transit and at rest
Every connection and every store.
Secrets in a managed vault
No shared passwords, no keys in code.
Least-privilege accounts with multi-factor authentication
Dedicated service accounts with the minimum permissions.
Personal information removed from logs
Application logs carry identifiers, not names or documents.
Backups with a tested restore
A backup counts only once it has been restored and checked.
An incident plan that includes your notification duties
Who is told, in what order, and how fast.
No third-party certification
We hold no third-party certification today. We are a founder-led company, and those audits are built for larger organisations.
What we offer instead is full documentation of each system, a written data map, and a standing invitation for your IT provider to review everything we build.
Your duties with client information
Most businesses in the sectors we build for carry duties over the client information they hold: privacy law in their province, the rules of a regulator or a professional body, and the terms of the agreements they sign with carriers, clients and partners.
Our part is to give you what you need to meet them. The data map states where each step is processed, so you can tell clients when a provider outside Canada is involved. The log of every automated action supports your record-keeping. Where more is at stake, every output is a draft for a person to review, which fits the guidance professional bodies give on generative AI. If an agreement restricts how client data may be handled, tell us and we design within it.
This is how we work, not legal advice. Your organisation and your counsel decide how your obligations apply.
Security questions
Send security or privacy questions to the address below. We reply within one business day.