Personal data vault Canada/Guide
Where my-id.ca data lives (plain English)
my-id.ca stores your data on servers in Canada, with backups in Canada and no routine replication outside the country. Data is encrypted with AES-256-GCM at rest and TLS in transit. All AI that touches your data runs on my-id.ca’s own servers — never OpenAI, Google, or Anthropic. Three sub-processors receive narrow slices: Stripe (billing), Google (only if you choose Google sign-in), and an email provider (transactional email). Deleting your account removes data immediately and rotates it out of backups within 30 days.
Storage and encryption
User data lives on servers hosted in Canada; backups are kept in the same jurisdiction, and we do not routinely replicate user data outside Canada. Sensitive fields are encrypted at rest with AES-256-GCM, every connection uses TLS, passwords are hashed with bcrypt and never visible to operators, and two-factor secrets are encrypted with the same at-rest scheme.
AI processing
Vault search, PDF filling, web-form filling, photo extraction, and voice transcription all run on infrastructure my-id.ca operates. Your data is not sent to OpenAI, Google, Anthropic, or any other third-party AI provider, and every AI suggestion is a draft you confirm before it is saved or sent.
Who else touches a slice of data
Three third parties receive narrow slices so the service can operate, and none are used for AI:
- Stripe — billing email, customer ID, and subscription status; card numbers go to Stripe directly and never touch our servers.
- Google — only if you choose "Sign in with Google"; we receive your Google account identifier and email.
- An email provider — your address and the message body for transactional email; profile fields are not included in notifications.
Deletion, breaches, and your rights
You can delete your account from Settings; deletion removes profile data, files, and templates from active databases, and encrypted backups containing deleted records rotate out within 30 days. For access, correction, or export requests, use the Data Requests page — it covers your rights under PIPEDA and other applicable laws.
If user data is ever accessed by an unauthorized party, we commit to notifying affected users within 72 hours of confirming the incident, publishing a public post-mortem, and notifying the Office of the Privacy Commissioner of Canada when the PIPEDA "real risk of significant harm" threshold is met. The Trust page is the canonical version of everything on this page — if they ever disagree, the Trust page wins.
Frequently asked questions
Does any my-id.ca data leave Canada?
User data and backups stay in Canada. The narrow exceptions are operational sub-processors: Stripe for billing details, Google if you opt into Google sign-in, and an email provider for transactional messages — none receive your vault content, and none are AI providers.
Can my-id.ca staff read my data?
my-id.ca does not claim zero-knowledge encryption: data is encrypted at rest and in transit, but the service can decrypt it to run search and autofill. Passwords are the exception — they are hashed and never visible to anyone. Our honest explainer on zero-knowledge vs self-hosted AI vaults covers the trade-off.
How fast is deleted data actually gone?
Immediately from active databases when you delete your account, and within 30 days from encrypted backups as they rotate out. Stripe retains billing records it is legally required to keep.
Where do I verify these claims?
The Trust page (my-id.ca/trust) is the source of truth and is kept current, including the sub-processor list and incident history. The Data Requests page covers exercising your PIPEDA rights.
Verify everything on the Trust page
Every claim about my-id.ca in this guide — hosting, encryption, sub-processors, deletion, breach commitments — is documented on the Trust page, which is the source of truth. Related reading: personal data vault Canada.
Store it once. In Canada. For free.
Create a free my-id.ca account — no credit card — and build the vault that powers your family's forms, PDFs, and document sharing.