Security & Trust
We ask you to trust us with your clinic. Here is what that is based on.
You are a health information custodian. Handing part of that duty to a vendor is a decision your regulator can ask you to justify — so this page describes what we actually do, in terms you can put in front of your insurer or your college. Where we have not done something yet, it says so.
Your records stay in Canada
The primary database runs in the Montreal region. Clinic profiles, account records and enquiries submitted through this site are stored in Canada, not shipped south by default. The parts of the service that do cross the border are named individually on the sub-processor list, with the country each one operates in.
Access rules live in the database, not the app
Every table enforces row-level security in PostgreSQL itself. A clinic can read its own records and nothing else, and that boundary holds even if application code has a bug — because the database, not the application, is what decides. We maintain a regression test suite against those rules and run it against a real database, not a mock.
Authentication fails closed
Every privileged route verifies the caller server-side before doing anything. If that verification cannot be completed — an outage, an unreadable token, an unexpected error — the request is denied rather than allowed through. We test this: an unauthenticated call to any private endpoint returns 401 or a redirect, never data.
We never see a card number
Payment happens on Stripe-hosted checkout pages. No card details are entered on our site, transmitted through our systems or stored by us — we receive confirmation that a payment succeeded and the identifiers for the subscription. That keeps card data entirely out of our environment by design, rather than by promise.
No tracking, no ad tech, no profiling
This website runs no analytics, no advertising pixels and no session recording. We do not store visitor IP addresses. The only third-party embed is the optional scheduler, and it does not load until you accept it. A security vendor that quietly instruments its own visitors is not one you should trust with your clinic.
Your data does not train models
Clinic records, security telemetry and any patient information that incidentally reaches us are never used to train or fine-tune machine-learning models, ours or anyone else’s. The AI that drafts our blog articles receives a topic string and nothing else — no customer data reaches it at all.
Assurance
Certifications and attestations
The part of a security vendor's website most likely to overstate itself. So here is our rule: nothing appears here without an auditor's report behind it.
We publish our certification status rather than a wall of logos. A certification is something an independent auditor issues after examining evidence. It is not a partner tier, not a compliance checklist we filled in, and not a credential one of our engineers holds personally. Those are four different things and only the first is a certification.
If your insurer, professional college or privacy officer needs assurance documentation to approve us, contact us and we will tell you precisely what we hold today, what is in progress, and what we do not have. You will get a straight answer, including where the answer is “not yet”.
Separately, we can provide the evidence package a clinic needs to demonstrate its own compliance position to a regulator — which is a different thing from us holding a certificate, and we will not let the two be confused.
Found a flaw in our systems?
Tell us. We publish a vulnerability disclosure policy with explicit safe harbour: research conducted in good faith under it is authorised, and we will not pursue you for it. We acknowledge reports within three business days, from a person.
Report to [[SECURITY EMAIL]] — or read the policy first.
Questions we get asked
Before you sign anything
The five questions a careful clinic owner, or their lawyer, asks us.
Where is our clinic data stored?
The primary database is hosted in Canada, in the Montreal region. Some supporting services — payments, transactional email, the optional scheduler — operate in the United States. Every one of them is named on our sub-processor page along with the country it operates in, so you can see exactly which parts cross the border.
Do you read our patient records?
No. The service watches how software and devices behave — process activity, network connections, logins — not the contents of patient charts. Some personal health information can appear incidentally in a file name, because clinics name files after patients. Where that happens it is handled under our Data Processing Addendum, used only to deliver the security service, and never used to train models.
Are you SOC 2 certified?
Our current certification and attestation status is published on this page and we do not claim anything we have not completed. If you need audit evidence to satisfy your insurer or professional college, contact us and we will tell you exactly what we hold today rather than send you a badge.
What happens if you have a breach?
We notify the affected clinic at the first reasonable opportunity — the standard Ontario health privacy regulation sets — with what we know at the time, and we keep updating as we learn more rather than waiting for a complete picture. The clinic, as custodian, decides on notifying patients. We support that decision; we never delay it.
Can we audit you?
Yes. Section 11 of our Data Processing Addendum gives every customer an annual audit right, including access to our security documentation and any third-party reports we hold, plus an independent auditor examination by agreement. A breach or a regulator request lifts the annual limit.
The binding commitments are in the Data Processing Addendum and the Privacy Policy.