Security and Data Residency

Q1 Where is our organization's data stored?

AIDARO uses a hybrid infrastructure model designed to protect Canadian data sovereignty for your permanent records while maintaining performance.

• Uploaded files and documents: Stored exclusively on dedicated servers within Canada. Uploaded files and attachments are not stored or processed on the US application server.
• Application processing: The core application platform runs on a dedicated server in the United States. This server is owned and operated exclusively by our organization. Structured application data, such as case records, contact information, and incident details, is processed here during normal application operation. Uploaded files and attachments are not stored on this server.
• System backups: All backups and disaster recovery archives are encrypted and stored within Ontario, Canada. The US application server is not used as a backup or disaster recovery repository.

Q2 Is this setup compliant with PIPEDA?

Yes, subject to your organization fulfilling its own obligations. PIPEDA permits cross-border data transfer and processing, provided the organization remains accountable for the information and appropriate contractual, technical, and organizational safeguards are in place.

AIDARO does not make your organization PIPEDA-compliant by itself. PIPEDA compliance also depends on your organization's own practices around collection authority, consent, retention, access, and privacy governance. What AIDARO provides is an architecture and contract that is designed to support your PIPEDA obligations, not replace them.

Our Data Processing Addendum formally documents the protections we put in place on your behalf.

Q3 Does a third-party cloud provider have access to our data?

No. AIDARO does not run on shared public cloud infrastructure such as Amazon Web Services, Microsoft Azure, or Google Cloud. Our application runs entirely on dedicated physical servers owned, managed, and controlled exclusively by our organization. Your data is never co-mingled with data from other companies or tenants.

Q4 Who has administrative access to the servers?

Physical and logical access to both our Canadian storage infrastructure and our US application server is strictly restricted. Only our internal system administrators are granted access. All administrators are comprehensively vetted and background-checked. No external contractors, cloud providers, or third-party vendors have standing access to the servers.

Q5 What is the risk from the US CLOUD Act?

Because our application platform runs on a server in the United States, temporary data sets processed by the application are subject to US jurisdiction. Under the US CLOUD Act, US federal authorities can compel data disclosures through valid legal orders.

We take several steps to reduce this risk as much as possible:

• The highest-sensitivity files (police reports, witness statements, case documents) are stored entirely in Canada and are not hosted on the US server.
• We review all legal requests carefully and use every available legal avenue to challenge requests that are overbroad or not properly authorized.
• We will notify your organization immediately of any intercept request unless we are legally prohibited from doing so.

Full details are documented in our Data Processing Addendum.

Q6 How is data protected in transit and at rest?

• In transit: All data moving between your organization's devices and our servers is protected using TLS (Transport Layer Security). This applies to all connections including between our Canadian and US infrastructure.
• At rest: All data stored on our servers, including on the Canadian file servers, the US application server, and the Ontario backup archives, is encrypted using AES-256 bit encryption.

Q7 What access controls does the platform use?

• Role-based access control (RBAC): Each user can only see and interact with the data their role permits. Access is set at the organization level by your administrators.
• Multi-factor authentication (MFA): MFA is available for all users and can be made mandatory by your organization's administrators.
• Audit logging: Every login, data change, and file access is logged and stored. Your administrators can access these logs at any time.
• Session management: Sessions expire after a set period. Inactive sessions are terminated automatically.

Q8 What happens if there is a security breach?

If we confirm a security incident that affects your organization's data, we will notify you within 24 hours. We will provide the technical details you need to meet your mandatory breach-reporting obligations to the Office of the Privacy Commissioner of Canada. We maintain a comprehensive incident response plan for exactly this scenario.

Q9 Can AIDARO support our privacy impact assessment or procurement review?

Yes. AIDARO provides organizations with the infrastructure details, security documentation, and data-flow information needed to support their own privacy impact assessment and procurement review process.

This is particularly relevant for Ontario provincial institutions subject to FIPPA, which are required to conduct a privacy impact assessment before collecting personal information. AIDARO can provide the technical and contractual documentation your process requires.

Each organization remains responsible for completing any assessment required by applicable law. AIDARO supports that process but does not replace it.