Careful with your clients' information.
Small firms hold confidential material. These are the standards we hold ourselves to on every engagement, written down so you can check them.
Least-privilege access
We ask for the minimum access a workflow needs, scoped to a single mailbox, folder or system wherever the platform allows it. We test that access outside that scope is refused.
Your systems, your accounts
Workflows run on your own server or instance, under accounts you own. Your data does not pass through our systems, and you keep what we build.
Every action is logged
Each automated step is recorded, so anyone on your team can see what happened, when, and why.
A person reviews what matters
Anything that affects money, legal rights or what a client is told is checked by a person before it goes out.
Secrets are kept out of workflows
Passwords and API keys are held in a secrets vault, not written into documents, messages or code, and we track their expiry dates.
Authenticated email
Our own mail is protected with SPF, DKIM and DMARC, so messages from this domain can be verified by the receiving side.
Backups we test
Our business data is backed up nightly to off-site storage, and we restore from those backups to prove they work.
Exceptions have an owner
When a workflow meets a case it was not built for, it stops and notifies a named person on your team instead of guessing.
Reversible and yours to leave
You control the off switch, we keep earlier versions of each workflow, and you receive written documentation. Nothing locks you in.
Canadian privacy law
We follow applicable Canadian privacy law. If your profession has its own guidance on AI and client data, we work within it.
What automation does not do
- AI output is a draft. It is never the final word on tax, legal, engineering or financial decisions.
- Automation reminds and files. It is not the system of record for legal deadlines.
- We do not train models on your client data, and we use the AI service your firm has approved.
Questions from your insurer, your professional body or your IT provider?
Send them to us. We will answer in writing before any work starts, and we are happy to complete a short security questionnaire.
Ask a question