Thoughtfully shaped for your work
Security
& Trust
Good security starts with knowing where information goes. We review access, hosting, connected providers and human oversight around each project. The public website uses external AI, email and hosting services.
On this page
● Fast Trust Path
What Are You Checking?
Most buyers do not need a wall of policy text first. Pick the question your team has and jump straight to the useful proof.
● Foundation
Six Pillars of Protection
Enterprise-grade security isn't a feature — it's the architecture. Every layer is built with defense in depth.
Encryption Everywhere
AES-256 encryption at rest. TLS 1.2+ for every byte in transit. Your data is unreadable without authorization — period.
Canadian Data Handling
Hosting and processing locations depend on the selected providers and project configuration. Canadian hosting or local processing can be a project requirement; the public website is not a Canada-only processing environment. For consultants, accountants and engineers, see private AI workflows for Canadian professional services.
Access Control
Role-based access with principle of least privilege. Multi-factor authentication for all administrative access. Need-to-know only.
Continuous Monitoring
Real-time security monitoring, intrusion detection, and 90-day log retention. Threats are detected before they become incidents.
Encrypted Backups
Automated encrypted backups with tested restoration procedures. Business continuity is planned, reviewed, and validated as part of production readiness.
Incident Response
Documented incident response procedures with 72-hour breach notification. If something happens, you know within hours — not weeks.
● Compliance
Built for Regulatory Reality
We don't just meet compliance requirements — we exceed them. Every framework is implemented with industry best practices.
PIPA
CompliantFull compliance with Alberta's Personal Information Protection Act (S.A. 2003, c. P-6.5). All data handling follows PIPA requirements for collection, use, and disclosure of personal information.
PIPEDA
CompliantFederal Personal Information Protection and Electronic Documents Act compliance for inter-provincial and cross-border data handling. 10 fair information principles implemented.
SOC 2 Type II
AlignedSecurity controls aligned with SOC 2 Trust Service Criteria — security, availability, processing integrity, confidentiality, and privacy. Formal certification in roadmap.
Data Processing
DPA ReadyComprehensive Data Processing Agreements for every enterprise client. Clear controller/processor roles, sub-processor controls, and breach notification commitments.
● Technical Specs
Under the Hood
Transparency builds trust. Here's exactly what protects your data at every layer of our stack.
● AI-Specific
Responsible AI Commitment
Public website services and private client deployments have different data flows. Review the providers, storage and data-use settings for the service you choose.
AI Providers & Data Use
The public AI Desk can send your message and recent conversation to OpenAI or OpenRouter and its selected model provider. Processing a request is different from training a model. Provider retention and data-use terms depend on the configured service; client training work requires a separate agreed scope.
Human Oversight Always
AI outputs are recommendations, not decisions. All significant business decisions remain under human control. No fully automated decision-making with legal or significant effects.
Auditable AI Processing
Audit events and retention are defined for each client workflow. The public AI Desk does not keep conversation text as a complete audit trail of every model input and output.
Isolated Client Environments
Client access boundaries, storage and connected providers are specified for the deployment. A private or local environment is a project choice; the public website chat is not an isolated client environment.
Website enquiry records can be stored in Netlify Blobs and Netlify Forms. Native form notifications can alert our business inbox. Read the website processing details before sending sensitive information.
● Security Desk
Need Proof For Your Team?
Send the exact security question. We review the request first, then reply with the right next step: DPA, privacy notes, AI data-control explanation, or a practical buying-team walkthrough.
No automatic outreach. No fake certifications. SOC 2 is listed as aligned, not certified, until formal certification is complete.
A conversation is where we start