Security and trust

Where your data lives, who can see it, and the documents a compliance reviewer needs, in one place.

The full set of documents lives in the Trust Center: security whitepaper, privacy policy, data retention, sub-processors, vulnerability disclosure, and the status of the SOC 2 audit. This page is the short version.

Where the data lives

• Database and files are hosted in Canada (Montreal region). The application runs from a Canadian region as well.
• Every table is protected by row level security. A firm's rows are visible only to that firm's seats, enforced by the database on every query, not by the application.
• A client sees only their own records. An advisor sees their own book. A firm owner sees the firm. Nobody sees another firm.

Who can see what

• Sign-in is email and password, with two-step sign-in by authenticator app available on every seat.
• Admin support seats act for an advisor only when the firm allows it, and every such read is written to the audit log.
• Sensitive numbers (social insurance numbers, government IDs, bank accounts) are encrypted at rest and shown as the last four digits. Full values are entered only at the moment paperwork is filled and are never stored in a client record or a log.
• AI features send only the rows needed for the question, never the whole book. Full names are cut to first names and account numbers and contact details are masked before they leave, and every call is logged under Operations > AI activity: the feature, the client, the model, the cost and what was masked, never the text itself.

Audit

• Every read of client data by staff, every form status change, every signature and every connector call is in the firm's Audit log, exportable.
• API keys and Claude connections appear under Settings > API access with their last use, and can be revoked in one click.

Compliance

• Built for CIRO-regulated dealers and portfolio managers in Canada: KYC and suitability records, trade-blotter-free by design, dealer paperwork with signature anchors.
• Privacy under PIPEDA, with how personal information is collected, used and kept set out in the privacy policy.
• SOC 2 Type 1 is planned: the controls are implemented today, and the independent audit has not started, so there is no report yet. The current status is in the Trust Center.
• Sub-processors are listed, with what each one receives, at /legal/sub-processors.html.

Reporting a problem

Security issues: follow the vulnerability disclosure policy. Anything else: the Help button in the app files a ticket that reaches the team directly.