Security & Compliance
The platforms we operate carry other businesses' customers, money and data. Security posture is designed in from day one, and this page states it plainly.
Data residency
Client data is hosted in the client's region. For Canadian clients, that means AWS ca-central-1 (Montréal) by default; other regions on request.
Compliance posture
We build to PIPEDA, Quebec Law 25, GDPR and India DPDP requirements, and support SOC 2 and ISO 27001 readiness programmes for clients who need them — delivered with certified partners where the depth requires it.
Engineering practices
Encryption in transit and at rest, least-privilege access, secure SDLC with review on every change, monitoring and alerting on every platform we operate.
On-premises & sovereign deployments
For on-premises and sovereign AI engagements, hosting, access, maintenance, monitoring and support responsibilities are defined explicitly in the engagement agreement — including which side operates which layer. On-premises deployment alone does not guarantee compliance or security; both depend on how the system is configured, operated and governed.
NDA on request
We sign your NDA before the first discovery call, or provide ours. Architecture diagrams and security documentation are shared under NDA.
Partners & technology
Our platforms run on AWS and integrate SAP, Unity and Stripe among others. Partner badges are shown only where an actual partner status is held.