Built for Canadian regulators
from day one.
All production data lives in AWS ca-central-1. Every design decision considers PIPEDA, OSFI B-13, and Quebec Law 25 obligations, because your clients' auditors will ask and your answer should be one sentence.
🍁 Canadian data residency
Every alert, case record, audit entry, and enrichment result is stored in AWS ca-central-1. No data crosses outside Canada in the default configuration. Cross-region deployments require explicit approval.
🔒 Encryption at rest and in transit
- Connector credentials: AES-256-GCM envelope encryption, per-tenant key isolation
- API ingestion keys: SHA-256 + bcrypt hashing, never stored in plaintext
- Database: AWS RDS encryption enabled
- All transport: TLS 1.2+ enforced via CloudFront (TLSv1.2_2021 policy)
🛡️ Authentication & access
- JWT tokens, 8-hour expiry, stored in sessionStorage
- TOTP MFA, per-tenant enforcement configurable
- Five roles: Viewer · Analyst · Senior Analyst · SOC Lead · Admin
- Bcrypt for all password hashing
- Per-IP rate limiting with a dedicated brute-force limit on auth endpoints
📋 Audit trail
Every verdict change, analyst override, escalation, and configuration change is logged with timestamp, actor, and before/after state. Records are HMAC-chained, no record can be modified without invalidating the chain, and exports are verifiable.
🏢 Tenant isolation
All DB queries carry a mandatory tenant_id scope. The query layer enforces isolation, there is no application-level "switch tenant" bypass. Per-tenant settings (confidence thresholds, disabled families, MFA policy) are stored and enforced independently.
🤖 LLM data handling
Alert data is sent to the Anthropic API at inference time only. Anthropic's API terms prohibit using customer data for model training. No alert content is stored in prompt logs. The model receives only the current alert + enrichment bundle per call.
The details your security
questionnaire will ask about.
Password policy
NIST-aligned 12+ character minimum with mixed character classes, enforced at every gate: invite, import, change, and admin reset. Every new password is checked against the HaveIBeenPwned breach corpus via k-anonymity, breached passwords are rejected.
Secret separation
The audit-chain key, session-signing key, and connector-encryption key are three independent secrets, held in AWS Secrets Manager. Production refuses to start if any two share a value.
Network posture
The database sits in private subnets, reachable only from the application tier. Strict CORS allow-listing, hardened HTTP headers, and a 1 MB request-body cap on all ingestion endpoints.
Data retention
Raw alert data is retained for 90 days by default (configurable per agreement). Database backups are encrypted and region-local. Pilot data is deleted on request at engagement close.
Subprocessors
Three, disclosed up front: AWS (ca-central-1 hosting), Anthropic (LLM inference), and the email delivery provider for notifications. The DPA lists each with its role and data scope.
Paperwork, same day
NDA, DPA, SLA, and the pilot agreement are standing documents, generated per client and ready for signature the day you ask.