Security,verified by independent audit.

Every framework on this page is audited annually by external firms. Reports available on request.

The frameworks covered.

International standards
- SOC 2 Type II
  Security, availability, processing integrity, confidentiality, privacy
  Annual audit, external firm
- ISO 27001
  Information security management system
  Certified, annual re-audit
- ISO 27701
  Privacy extension to the ISMS
  Certified, annual re-audit
Federal, Canada
- PIPEDA
  Personal Information Protection and Electronic Documents Act
  Compliant, OPC Canada
Provincial, Quebec
- Law 25
  Personal information and associated rights
  Compliant, CAI Quebec
Sectoral, Financial services
- AMF
  Sound governance practices, 30 responsible-AI guidelines
  Covered, internal audit
- CIRO
  Retention of advisor-client communications
  Covered, audit trail
Electronic signature
- AATL
  Adobe Approved Trust List, legally-binding signatures
  GlobalSign

Every action (read, said, written, signed) emits a line into the audit trail. Exportable, timestamped, verifiable.

Excerpt, audit trail

Format meets CIRO and Law 25 retention requirements

Data residency
100% Canada.
No client data leaves Canadian soil. Storage, processing, backups, all stays in Canada.
Primary region, ca-central, Toronto. DR region, ca-east, Montréal.
Encryption
AATL-certified signing.
AATL-certified e-signatures via GlobalSign. TLS 1.3 in transit, AES-256 at rest, KMS-managed keys separated from data.
Issuing CA: GlobalSign Document Signing CA. SHA-256 fingerprint, qualified timestamp.
Retention
Seven years, by default.
All communications, signatures, and operations are retained for seven years, the duration CIRO requires for advisor-client communications.
Deletion on request, with deletion itself logged to the audit trail.

Evaluator, buyer, or compliance officer? Request trust-center access and we provision the evaluation environment in under a day.