Personal data vault Canada/Guide
Where my-id.ca data lives (plain English)
my-id.ca stores core records and secure guest uploads on servers in Canada, with encrypted backups in Canada. Data is encrypted with AES-256-GCM at rest and TLS in transit. AI runs on infrastructure my-id.ca operates; uploaded documents are not sent to external AI providers. Email starts at our mail server in Beauharnois, Québec, then passes through delivery networks and the recipient's provider, which may be outside Canada. Stripe handles billing details, optional Google services handle sign-in or calendar events, and OVHcloud hosts the Québec mail server. Internet traffic may cross a border even when our server is in Canada. See the Privacy Policy for the full data flows and deletion terms.
Storage and encryption
Core records are hosted in Canada and email starts at our Québec mail server. Sensitive fields and TOTP secrets use AES-256-GCM; passwords are hashed with bcrypt. HTTPS/TLS protects public connections; internal local connections may use HTTP.
AI processing
Vault search, PDF filling, web-form filling, photo extraction, and voice transcription all run on infrastructure my-id.ca operates. Your data is not sent to OpenAI, Google, Anthropic, or any other third-party AI provider, and every AI suggestion is a draft you confirm before it is saved or sent.
Who else touches a slice of data
The Privacy Policy describes payment providers, optional Google integrations, email delivery, and DNS and certificate services. These are not used for AI inference:
- Stripe — billing email, customer ID, and subscription status; card numbers go to Stripe directly and never touch our servers.
- Google — only if you choose "Sign in with Google"; we receive your Google account identifier and email.
- An email provider — your address and the message body for transactional email; profile fields are not included in notifications.
Deletion, breaches, and your rights
Request deletion in privacy settings. After approval, deletion is normally scheduled 30 days later. Contact the privacy officer about custom-portal records and any timing requirements; a deletion request is broader than removing a domain.
We notify affected businesses without undue delay after becoming aware of a breach affecting their data. Individual and regulator notifications follow applicable legal deadlines; PIPEDA requires notice as soon as feasible for a breach posing a real risk of significant harm. The Privacy Policy and DPA describe our obligations; this page and the trust centre summarize them.
Frequently asked questions
Does any my-id.ca data leave Canada?
Core records and secure guest uploads are received and stored on our Canadian server. Optional Stripe billing and Google sign-in may process limited account data abroad; optional Google Calendar sync may send event details, including client details, to Google. Email leaves our Québec server for delivery through the recipient's provider, which may be elsewhere. Encrypted Internet traffic may cross a border. Uploaded documents are not sent through the optional Stripe or Google integrations.
Can my-id.ca staff read my data?
my-id.ca does not claim zero-knowledge encryption: data is encrypted at rest and in transit, but the service can decrypt it to run search and autofill. Passwords are the exception — they are hashed and never visible to anyone. Our honest explainer on zero-knowledge vs self-hosted AI vaults covers the trade-off.
How fast is deleted data actually gone?
Immediately from active databases when you delete your account. Stripe retains billing records it is legally required to keep.
Where do I verify these claims?
The Trust page (my-id.ca/trust) is the source of truth and is kept current, including the sub-processor list and incident history. The Data Requests page covers exercising your PIPEDA rights.
Verify everything on the Trust page
Every claim about my-id.ca in this guide — hosting, encryption, sub-processors, deletion, breach commitments — is documented on the Trust page, which is the source of truth. Related reading: Personal data vault.
Store it once. In Canada. For free.
Create a free my-id.ca account — no credit card — and build the vault that powers your family's forms, PDFs, and document sharing.