Built for Canadian regulators
from day one.
Case data, audit trail, and infrastructure live in AWS ca-central-1. Every design decision considers PIPEDA, OSFI B-13, and Quebec Law 25 obligations, because your clients' auditors will ask exactly what leaves Canada and what doesn't, and you should be able to answer precisely.
🍁 Canadian data residency
Every alert, case record, audit entry, and enrichment result is stored in AWS ca-central-1, and nothing is stored outside Canada in the default configuration. Alert content makes one necessary trip outside Canada during AI analysis, and a single indicator (an IP or a hash, not the alert) leaves for reputation lookups, both disclosed below and in the DPA. Cross-region storage requires explicit approval.
🔒 Encryption at rest and in transit
- Connector credentials: AES-256-GCM envelope encryption, per-tenant key isolation
- API ingestion keys: SHA-256 + bcrypt hashing, never stored in plaintext
- Database: AWS RDS encryption enabled
- All transport: TLS 1.2+ enforced via CloudFront (TLSv1.2_2021 policy)
🛡️ Authentication & access
- JWT tokens, 8-hour expiry, stored in sessionStorage
- TOTP MFA, per-tenant enforcement configurable
- Five roles: Viewer · Analyst · Senior Analyst · SOC Lead · Admin
- Bcrypt for all password hashing
- Per-IP rate limiting with a dedicated brute-force limit on auth endpoints
📋 Audit trail
Every verdict change, analyst override, escalation, and configuration change is logged with timestamp, actor, and before/after state. Records are HMAC-chained, no record can be modified without invalidating the chain, and exports are verifiable.
🏢 Tenant isolation
All DB queries carry a mandatory tenant_id scope. The query layer enforces isolation, there is no application-level "switch tenant" bypass. Per-tenant settings (confidence thresholds, disabled families, MFA policy) are stored and enforced independently.
🤖 LLM data handling
Alert data is sent to the Anthropic API at inference time only. Anthropic's API terms prohibit using customer data for model training. No alert content is stored in prompt logs. The model receives only the current alert + enrichment bundle per call.
The details your security
questionnaire will ask about.
Password policy
NIST-aligned 12+ character minimum with mixed character classes, enforced at every gate: invite, import, change, and admin reset. Every new password is checked against the HaveIBeenPwned breach corpus via k-anonymity, breached passwords are rejected.
Secret separation
The audit-chain key, session-signing key, and connector-encryption key are three independent secrets, held in AWS Secrets Manager. Production refuses to start if any two share a value.
Network posture
The database sits in private subnets, reachable only from the application tier. Strict CORS allow-listing, hardened HTTP headers, and a 1 MB request-body cap on all ingestion endpoints.
Data retention
Raw alert data is retained for 90 days by default (configurable per agreement). Database backups are encrypted and region-local. Pilot data is deleted on request at engagement close.
Subprocessors
Disclosed up front: AWS (ca-central-1 hosting), Anthropic (LLM inference), threat-intelligence providers for reputation lookups (AbuseIPDB, VirusTotal, Shodan, URLhaus), and the email delivery provider for notifications. The DPA lists each with its role and exactly what data it receives.
Paperwork, same day
NDA, DPA, SLA, and the pilot agreement are standing documents, generated per client and ready for signature the day you ask.