Control frameworks we build to
183 controls in the register, every one with a named owner, an implementation note and a review date. 162 are implemented, the remainder are in progress, planned or formally not applicable with a written justification. Eleven automated collectors verify the technical controls every day, shown below. We publish the real state rather than a finished looking one, and we hold no certification until an accredited body awards it.
ISO/IEC 27001:2022
Information security management
ISO/IEC 42001:2023
AI management system
SOC 2 Trust Services Criteria
Security, availability, confidentiality, privacy
PIPEDA and Alberta PIPA
Canadian privacy law, applies today
Live control evidence
Automated collectors run daily on our production infrastructure and file each result against its controls. Last collection 2026-08-29.
| Check | Result | Detail |
|---|---|---|
| Backup freshness | PASS | Backup artifacts verified fresh within the last 24 hours |
| Database access review | INFO | Database login roles enumerated and reviewed daily |
| Capacity management | PASS | Storage utilisation within planned thresholds |
| Network firewall | FAIL | Firewall state requires attention, remediation open |
| Logging and intrusion prevention | PASS | System logging and intrusion prevention active |
| Privileged access review | INFO | Interactive accounts and administrator group reviewed daily |
| Vulnerability patching | FAIL | Security updates are pending, patching in progress |
| Service availability | PASS | All production services online |
| Server access hardening | PASS | Key based administrative access only, interactive password login disabled |
| Clock synchronisation | PASS | Production clock synchronised, required for reliable audit trails |
| Encryption in transit | PASS | Valid TLS certificates on every public domain, expiry monitored daily |
The written policy set
16 policies, each with a named owner and an annual review date, held in the same system as the controls they govern. All of them are approved and published by the Chief Executive Officer. We list the state of each rather than claim a finished set.
- Information Security PolicyPublished
- Access Control PolicyPublished
- Acceptable Use PolicyPublished
- Data Protection and Privacy PolicyPublished
- Incident Response PolicyPublished
- Business Continuity and Backup PolicyPublished
- Change and Configuration Management PolicyPublished
- Cryptography and Key Management PolicyPublished
- Logging and Monitoring PolicyPublished
- Vulnerability and Patch Management PolicyPublished
- Supplier and Third Party PolicyPublished
- Asset Management PolicyPublished
- Human Resources Security PolicyPublished
- Secure Development PolicyPublished
- AI Management PolicyPublished
- Risk Management PolicyPublished
Certification status
Security questionnaire, answered
The answers most buyers ask for, published in advance. Need it as a completed questionnaire or in your own template, ask and we return it same day.
Hosting
Where is our data hosted?
All systems run on a single dedicated OVH VPS located in Beauharnois, Quebec, Canada. Client data never leaves Canada.
Do you use third party subprocessors?
Infrastructure is self hosted. We do not use third party compliance, CRM or data processing SaaS for client data. Domain DNS is on Cloudflare and outbound mail is self hosted Postfix on the same server.
Access control
How is access to production controlled?
Key only SSH on a non standard port with password authentication disabled and root password login disabled. Application access is behind Keycloak single sign on. Sudo is limited to one named administrator account.
Is multi factor authentication available?
Keycloak single sign on fronts every application surface and supports enforced MFA.
Encryption
Is data encrypted in transit?
TLS on every public endpoint across all six domains, with certificate expiry measured daily by an automated collector and recorded as control evidence.
Resilience
What is your backup regime?
Automated database and application backups on the VPS, freshness verified daily by an automated evidence collector that fails if the newest artifact is older than two days.
What is your uptime target?
99.9 percent. All twelve production services are monitored continuously and their state is recorded daily as compliance evidence.
Vulnerability management
How do you handle patching?
Pending OS and security updates are checked daily by an automated collector. Any pending security update raises a failed control and is remediated by the Technology team.
Monitoring
Do you have logging and intrusion prevention?
System logging via journald and rsyslog, plus fail2ban intrusion prevention, both verified daily. Application level audit logging is native to The Office.
Incident response
Do you have an incident response process?
Yes. Incidents are triaged by the Technology security function, escalated to the CEO, and recorded with findings and corrective action in The Office audit module.
Privacy
Which privacy laws apply to you?
PIPEDA federally and Alberta PIPA provincially. We are a Canadian company processing Canadian personal information on Canadian infrastructure.
Who is accountable for privacy?
Our Legal function holds the designated accountability for personal information, supported by a dedicated compliance owner.
How do you handle a data subject access request?
Requests go to our Legal function, are logged in The Office, and are answered within thirty days as required by PIPEDA.
What is your breach process?
Breaches of security safeguards are recorded, assessed for real risk of significant harm, and reported to the Office of the Privacy Commissioner of Canada and to affected individuals where that threshold is met.
AI governance
Do you use AI to process client data?
Yes, and it is our core operating model. Every AI agent, model, prompt surface and data flow is inventoried in an AI asset registry built to the ISO/IEC 42001 control set.
Is client data used to train models?
No. Client data is not used to train or fine tune any model. Our speech to text runs fully offline on our own server with zero external calls.
What human oversight exists over AI decisions?
Every externally visible or financially material AI action requires human approval. Agents escalate through a routing officer to the human operator.
How do you assess AI risk?
Each registered AI asset carries a documented purpose, data classes, oversight mechanism and risk level, reviewed on the ISO 42001 impact assessment cycle.
Governance
Do you have documented security policies?
Yes. A set of 16 policies covering information security, access control, data protection under PIPEDA, incident response, continuity, cryptography, logging, patching, suppliers, secure development, AI management under ISO 42001 and risk management. Each carries a named owner, a version and an annual review date, and is held in the same system as the controls it governs. Current approval state for every policy is published on our trust centre.
Are you certified to ISO 27001 or SOC 2?
Not yet. Our control register is built to the ISO/IEC 27001:2022 Annex A, ISO/IEC 42001:2023 and SOC 2 Trust Services Criteria control sets, with automated daily evidence collection. External certification will be pursued when a client engagement requires it.
How often are controls reviewed?
Technical controls are tested daily by automated collectors. Every control in the register carries a named owner and a scheduled review date on a 90 day cycle, verified by the compliance officer.
Personnel
Do staff sign confidentiality agreements?
Yes, human contractors and staff are bound by confidentiality terms. AI employees operate under enforced code level confidentiality gates.
Is there security awareness training?
Yes, delivered through our internal training programme including the Working with AI Employees curriculum.
Business continuity
What happens if your primary server fails?
Backups plus documented rebuild procedures allow full reconstruction of the estate. Recovery procedures are tested on the continuity cycle.
Change management
How are changes to production controlled?
Changes flow through version control and deployment pipelines with review before release, and quality gates that block failing releases.