Security & Data Handling

We handle order data carefully. Here's how we keep it safe and give you control.

How we protect your data

Practical security measures for real business data. Not security theater — actual practices that protect your customers' information.

Read-only first

When we connect to your existing systems, we start read-only. We see data before we write to it, so you can verify what we're doing.

Role-based access

Control who sees what. Staff, managers, and customers each get the view they need — nothing more. You manage permissions.

Audit trail

Every change is logged. Know who did what, when, and why. Useful for compliance requirements and troubleshooting.

Regular backups

Your data is backed up regularly to multiple locations. If something goes wrong, we can restore to a known good state.

Data export & deletion

Your data stays yours. Export it anytime in standard formats. Request deletion and we'll confirm when it's complete.

Subprocessor transparency

We use trusted infrastructure partners for hosting and services. Our subprocessor list is available on request.

AI disclosure

When we use AI to help with intake categorization or text extraction, we tell you. No hidden automation on your data.

Encryption

Data is encrypted in transit (TLS) and at rest. Your customer information never travels unprotected.

Infrastructure

Hosted on AWS infrastructure in Canadian regions where available. Benefit from enterprise-grade physical security.

Authentication

Strong password requirements, session management, and optional two-factor authentication for admin accounts.

Compliance & certifications

We follow security best practices appropriate for handling business order data. For specific compliance requirements (SOC 2, industry-specific regulations), please contact us to discuss your needs.

We continually evaluate compliance requirements. Contact us to discuss specific certifications and compliance needs.

Questions about security?

We're happy to answer specific questions about how we handle data, discuss your compliance requirements, or provide additional documentation.