- Law 25 · s. 3.1A person in charge of protectionThe firm designates who oversees personal information.
- A dedicated team role, “person in charge of the protection of personal information”, with access to the firm's activity log.
- Law 25 · s. 17Disclosure outside QuébecA privacy impact assessment is required before personal information is disclosed outside Québec.
- In private mode, nothing leaves the computer. Hybrid mode is off by default and turning it on is logged. We document our data flows to support your own assessment.
- Law 25 · s. 9.1Privacy by defaultThe settings offering the highest level of confidentiality apply by default.
- Hybrid mode off, search history that can be turned off, a masked version offered before every public research request.
- Law 25 · s. 23Limited retentionInformation is destroyed or anonymized once the purpose for which it was collected is achieved.
- Search history deleted after 12 months, or never kept. Closed accounts deleted within 90 days. Your files stay under your control, on your computer.
- Law 25 · ss. 3.5 to 3.8Confidentiality incidentsA register of incidents; notice to the Commission d'accès à l'information and to the persons concerned when there is a risk of serious injury.
- A time-stamped log of access, roles and licences to document an incident. On our side, an incident register and notice to the firm concerned.
- PIPEDA · Schedule 1The ten principlesAccountability, limiting collection, safeguards, openness, among others.
- Minimal collection: we do not receive your files. Two-step authentication, roles, encrypted exchanges, a privacy policy in plain language.
- PIPEDA · ss. 10.1 and 10.3Breaches of security safeguardsReport to the Commissioner when a breach creates a real risk of significant harm; a record of every breach.
- The same time-stamped log gives you the facts: who, what, when. We notify you of any incident that affects your firm.