Security Overview

1. Overview

{{COMPANY_LEGAL_NAME}} uses reasonable administrative, technical, and organizational measures designed to protect personal information and customer data. This page describes those practices at a high level. It is provided for informational transparency and is not a contractual warranty.

Our practices evolve over time as technology and threats change. Where a customer contract specifically references security commitments, that contract controls.

2. Access and Administrative Controls

We limit internal access to personal information and customer data to authorized persons who need that access for a specific operational, support, security, or legal purpose. Common practices include:

• least-privilege access principles for internal tools and systems;
• role-based access for product features where appropriate;
• separation between production and non-production environments;
• offboarding procedures when access is no longer needed.

Authentication may be handled through one or more methods, including third-party providers such as Google or other identity providers. Where third-party authentication is used, credential verification and session issuance occur on the provider’s side; we only receive the authenticated identity they return.

3. Infrastructure and Service Providers

We rely on reputable third-party providers for hosting, cloud infrastructure, payment processing, email, analytics (where applicable), and AI services. We select providers that publicly commit to recognized security practices and review them before onboarding.

Where applicable, we put contractual safeguards in place (for example, data processing agreements or equivalent). We do not independently audit our providers’ infrastructure and rely on their controls in addition to our own.

4. Data Handling

We use HTTPS/TLS to protect data in transit between your browser and the Service. At rest, data is stored with encryption features provided by our cloud and database providers; we do not publish precise algorithm or key-length details for every component.

We do not hold formal certifications such as SOC 2 or ISO 27001 unless explicitly stated in writing. If a specific level of detail is required for your compliance program, contact us at {{COMPANY_COMPLIANCE_EMAIL}}.

When you use AI-powered features, the prompts, files, instructions, and related content you submit — and the outputs generated in response — are transmitted to and processed by third-party AI providers (for example, Microsoft Azure OpenAI, OpenAI, or Google Gemini / Veo). Some of these providers may process information outside Québec or Canada, including in the United States.

We do not intentionally use customer content to train our own general AI models. Where we rely on third-party AI providers, their processing may be governed by their own service terms and data-handling practices, which we do not control. We encourage you to review those terms before submitting sensitive information. If you have questions about a specific provider we use, please contact us at {{COMPANY_COMPLIANCE_EMAIL}}.

5. Incident Handling

If we become aware of a security incident affecting personal information or customer data, we will take steps we consider reasonable under the circumstances, which may include:

• investigating the incident and taking containment steps;
• working with our providers where relevant;
• providing notifications required by applicable law (for example, under PIPEDA or Québec’s Law 25).

We do not commit to a specific notification deadline outside what the law requires. You can report a suspected incident or a good-faith security finding to {{COMPANY_COMPLIANCE_EMAIL}}.

6. User Responsibilities

Security is a shared responsibility. You are responsible for:

• maintaining the confidentiality of your account credentials, regardless of the authentication method used;
• managing access and roles for users in your workspace;
• promptly removing access for people who no longer need it;
• keeping your devices and networks reasonably up to date and protected;
• using the Service responsibly and in line with our Acceptable Use Policy.

No system is 100% secure, and we do not guarantee that the Service will always be available, free of vulnerabilities, or immune from unauthorized access.

7. Contact

For security questions or good-faith security reports, contact us:

{{COMPANY_LEGAL_NAME}}
Email: {{COMPANY_COMPLIANCE_EMAIL}}
Website: {{COMPANY_WEBSITE}}