Trust

Client records and documents uploaded through the secure guest portal are received and stored on our server in Canada, with encrypted backups kept in Canada. We operate our mail server in Beauharnois, Québec. Once mail leaves that server, the recipient's provider and delivery networks handle it. Encrypted Internet traffic may cross a border even when our server is in Canada.

A business's custom portal address is checked for ownership, approved Canadian routing and HTTPS before activation and afterward. Optional Stripe and Google account services may handle limited account data outside Canada. If a business connects Google Calendar, event details may include information about its clients. The Privacy Policy explains these flows.

A business can use its own subdomain, name, logo and colours for client document and signing links. We still operate the secure portal and process client data for that business. The business controls its linked privacy notice; our client notice explains our role. Our app addresses my-id.ca and hivi-x.ca use Canada's .ca domain. A business's custom domain does not have to use .ca and may be registered or managed through providers outside Canada. Connected custom portals still use our Canadian document storage; a domain ending alone does not establish data residency.

We check domain ownership, routing to our approved Canadian ingress and HTTPS before activation, and recheck afterward. New links use the platform address if those checks fail. Transactional email may show the business name and reply-to address, but the sending address remains on our approved domain. DNS and certificate services may process domain metadata outside Canada; certificate names are public. No client documents or verification codes are sent to them.

• At rest: AES-256-GCM. Sensitive fields are encrypted in our database.
• In transit: HTTPS with TLS 1.2 or 1.3 protects traffic between your browser and our public ingress. Behind the ingress, services on the same server talk to each other over the local loopback interface without TLS; that traffic does not leave the machine.
• Passwords: never stored in plain text and never visible to operators. See Password security below for the hashing algorithm and policy.
• Two-factor secrets: TOTP shared secrets are encrypted at rest with the same AES-256-GCM scheme.

• Hashing: passwords are hashed with bcrypt at cost factor 10 before storage. The plain-text password is discarded immediately after hashing and is never written to logs, backups, or analytics.
• Length policy: minimum 8 characters, maximum 128 characters. Any printable characters are accepted, including spaces and Unicode — long passphrases are encouraged over short complex passwords.
• Reset flow: password reset links are single-use, expire after 1 hour, and are sent only to the account's verified email address.
• Two-factor authentication: TOTP (Google Authenticator, 1Password, Authy, etc.) is available for every account. We strongly recommend enabling it from Settings → Security.
• Passkeys (WebAuthn): you can register one or more passkeys (Touch ID, Face ID, Windows Hello, or a hardware security key) and sign in without a password. Passkeys are phishing-resistant because the private key never leaves your device. Manage passkeys from Settings → Security. Each passkey is bound to a single domain (my-id.ca or hivi-x.ca) — if you use both, register a passkey on each.
• Refresh tokens for the Chrome extension: when you sign in via the extension we issue a refresh token so you don't have to type your password again every time the short-lived access token expires. Refresh tokens are opaque random strings; only their SHA-256 hash is stored on our servers. Each refresh rotates the token, and any attempt to reuse an older one revokes the whole token family for that device — a token theft can't survive a single legitimate refresh. Signing out of the extension or hitting Sign out everywhere on the web revokes them immediately.
• Federated sign-in: "Sign in with Google" is supported as an alternative to a password. When used, your account has no password set on our side until you choose to add one.
• What we don't do yet: we do not currently check new passwords against the Have I Been Pwned breach corpus. This is on our roadmap; in the meantime, the strongest configuration we offer is a passkey, or a unique passphrase combined with TOTP.

All AI extraction and form-mapping that touches your data runs on servers we operate. We do not send your data to OpenAI, Google, Anthropic, or any other third-party AI provider.

• Speech-to-text: Faster-Whisper, running on our own infrastructure.
• Language model (form mapping, extraction, chat): Gemma, self-hosted on our own infrastructure via Ollama.
• AI output is a draft. Every AI-suggested value is shown for you to review and confirm before it is saved or sent. See our AI Reliability Notice for details on how to review AI suggestions safely.

AI features are the part of a document tool most likely to send your files somewhere else. Ours do not. Every model named below runs on hardware we operate in Canada, reached over our own private network — there is no third-party AI provider in the path, on any plan.

• The models, by name Speech-to-text uses Faster-Whisper. Document and form understanding, AI search, and chat use Gemma; image and scan reading uses LLaVA. Both language models are served by Ollama on our own server.
• What leaves our servers For AI processing: nothing. Your documents, their contents, and the prompts built from them are never sent to OpenAI, Anthropic, Google, or any other AI provider, and are never used to train a public model. (Payments, email delivery and Google sign-in are separate, unrelated processors — they are listed in the table below.)
• What we record about AI use AI usage counters record the feature, model, source and token counts. Prompt text and model answers are not stored in these counters. Saved conversations, attachments and generated documents are separate records that may be retained to provide the requested features.
• Why this is built this way Self-hosting lets us control the infrastructure that processes documents. It does not remove our privacy, security, retention or provider-assessment obligations.

These services receive the data categories shown below when the relevant feature is used. They are not used for AI inference.

If we add a new sub-processor we will update this page. If you want a notification when this list changes, email support@my-id.ca.

• Ordinary autofill suggestions are off by default for each site. Separate actions you start—AI chat, imports, PDF assistance and client capture—can process content even when autofill is off; Privacy Policy Section 20A describes these actions.
• Ordinary suggestions use field labels, metadata and the page URL. Separate chat, import and capture actions you start can send page text, form values or files to my-id.ca, as described in Privacy Policy Section 20A.
• Signing in through the my-id.ca website gives the extension tokens through a one-time handoff. If you instead use popup sign-in, the extension receives and submits your email, password and, when required, TOTP code. Allowed origins are described in Privacy Policy Section 20A.
• You can disable a site or uninstall the extension at any time; there is no server-side state holding the extension open. Signing out of the extension revokes its refresh token on the server.

• We keep your data for as long as your account is active.
• Request deletion in privacy settings. After approval, deletion is normally scheduled 30 days later. Contact the privacy officer about custom-portal records and any timing requirements; a deletion request is broader than removing a domain.
• Encrypted backups are kept in Canada. Deletion from active systems does not immediately erase archive copies. Backup erasure timing must be confirmed for your request; we do not guarantee a 30-day period here.
• Stripe retains billing records on its side as required by tax and payment regulation; we cannot delete data Stripe is legally required to keep.
• For access, correction, export, or deletion by request, see our Data Requests page — it covers the rights you have under PIPEDA, Quebec Law 25, and GDPR, and how to exercise them.

We design with PIPEDA, PHIPA, GDPR and HIPAA principles in mind and the encryption / access patterns above are aligned with their technical safeguards. However:

We do not currently hold a third-party attestation, SOC 2 report, or formal certification against HIPAA, PHIPA, or GDPR. Until that changes, please do not treat the absence of such badges as a typo on our part.

If you represent an organisation that needs an attestation or a vendor questionnaire, email support@my-id.ca and we will be candid about what we can and can't sign.

If we discover that user data was accessed by an unauthorised party, we will:

• We notify affected businesses without undue delay after becoming aware of a breach affecting their data. Individual and regulator notifications follow applicable legal deadlines; PIPEDA requires notice as soon as feasible for a breach posing a real risk of significant harm.
• Publish a public post-mortem on this page (under Incident history) describing what happened, what data was involved, and what we changed afterwards.
• Notify the Office of the Privacy Commissioner of Canada when the incident meets the PIPEDA "real risk of significant harm" threshold.

No reportable incidents to date.

Privacy questions, deletion requests, sub-processor questions, and reports of suspected incidents: support@my-id.ca.

To exercise your access, correction, export, or deletion rights, see Data Requests. For the full legal text, see our Privacy Policy.