Security and hosting in Quebec

1. Where your data lives

The infrastructure that hosts your association's data is located in Quebec:

• Web application: served by Vercel from the Montreal (yul1) region.
• Database and stored files: Supabase, ca-central-1 (Montreal) region.
• Email delivery and reception: Amazon SES, ca-central-1 (Montreal) region.
• Analysis of imported documents (maintenance log, reserve fund study, bank statement, vendor invoice, declaration of co-ownership): self-hosted service at OVHcloud, in Beauharnois (Quebec).
• Primary backups: kept in Quebec, in Montreal.
• Secondary backups: kept in Quebec, in Beauharnois, with a separate provider.
• Checking a contractor's RBQ licence: VériBât, another service of Solutions Nicvi inc. (the same company as CondoAide), running in the Montreal (yul1) region.
• Bot check on public forms (sign-in, sign-up, contact form, free tools): Cloudflare Turnstile, on Cloudflare's global network, outside Quebec; it receives technical data from the browser, never the content of a form or a document.
• Your condo association data (registry, finances, documents, communications, minutes) is hosted in Canada. Some of it is sent outside Canada: subscription payments via Stripe, marketing emails and the fallback relay for transactional emails via Brevo in the European Union, Anthropic's artificial intelligence features in the United States, and Cloudflare's bot check (Turnstile) on its global network. These cases are described in section 6 below and in section 9 of the Privacy Policy.

2. Encryption

Encryption happens at several levels, each with a specific role:

• Data at rest — AES-256 on the database, backups and stored files. Managed by the underlying infrastructure (AWS, which hosts Supabase's ca-central-1 region).
• Data in transit — TLS 1.3 between your browser, our application and our internal services.
• Passwords — Hashed with bcrypt. Hashing is one-way — your passwords are never stored in plain text, never reversible, and no one at CondoAide (including administrators) can read them. This is intentional and is the correct practice.
• Authentication tokens (JWT) — Cryptographically signed with ECDSA on the P-256 curve (ES256). The signature is asymmetric: the key that signs tokens is never shared with the services that verify them, and a token cannot be tampered with without detection.

3. Quebec Law 25

Since 2023, Quebec Law 25 (An Act to modernize legislative provisions as regards the protection of personal information) places direct obligations on condo associations, which are responsible for the personal information of their unit owners. Here are the measures CondoAide has put in place:

• Designated Privacy Officer publicly named at CondoAide — see section 7 of our Privacy Policy.
• Governance policies and practices adopted on July 30, 2026 — incident response procedure, incident register, complaints handling procedure and retention schedule. The public summary is on our Governance page.
• Internal incident registry maintained, with a commitment to notify Quebec's Commission d'accès à l'information within 72 hours of confirming a risk-bearing incident.
• Data retention and destruction policy with specific timelines per data category — see section 5 of our Privacy Policy.
• Right of access and rectification: each unit owner can view and correct their personal information through the platform or by contacting the Privacy Officer.
• Hosted in Quebec: in our assessment, hosting the application, the database and email delivery in Quebec does not constitute a transfer outside Quebec within the meaning of Law 25. The contractually governed flows that do leave Quebec (subscription billing, marketing emails and the fallback relay for transactional emails, artificial intelligence features, bot check on public forms) are listed in section 6.

4. Access and audit logging

Access to your association's data is strictly controlled:

• Granular permissions: board administrators, unit owners and residents have distinct access levels defined by your declaration of co-ownership.
• Strong authentication: a second factor is available for all accounts, through an authenticator app or a device key (Touch ID, Face ID, security key). Biometric verification happens on your device: your fingerprint or face is never sent to us, and we receive only a public key and a signature. A key synced by your password manager (iCloud Keychain, Google, 1Password) is also kept, encrypted, by that provider, possibly outside Québec; CondoAide sends it nothing.
• Audit log: every sensitive action (viewing financial documents, modifying the registry, generating certificates) is logged and timestamped.
• CondoAide staff access: limited to people with a specific operational need (technical support, troubleshooting), logged, and subject to confidentiality agreements.

5. Backups and business continuity

Your association cannot afford to lose its registry, minutes or maintenance log. Our backup strategy follows the industry standard 3-2-1 principle (three copies, two media, one offsite):

• Supabase backups: point-in-time recovery over 7 days plus daily snapshots.
• Additional backups in Quebec — Montreal: database backups every 4 hours and storage files daily, kept 30 days.
• Additional backups in Quebec — Beauharnois: daily mirror copy at a second distinct Quebec provider, for geographic resilience.

6. Sub-processors

CondoAide relies on a small number of specialized providers. All are contractually bound to confidentiality and personal-information protections equivalent to those Quebec law requires. For the main sub-processors:

• Vercel — Hosting of the web application, Montreal (yul1) region. SOC 2 Type 2 certified.
• Supabase — PostgreSQL database, authentication, file storage. ca-central-1 (Montreal) region. SOC 2 Type 2 certified.
• Stripe — Two uses: (1) payment of your CondoAide subscription (credit card, PAD) and (2) automatic condo-fee collection by pre-authorized debit (PAD/ACSS). For the second use, Stripe processes the banking information of co-owners who enable the debit and the private portion’s technical identifier, then deposits the funds directly into the syndicate's account (Stripe Payments Canada, Ltd., operating under Payments Canada rules). The account identifier of the person who authorizes the mandate stays in CondoAide. SOC 2 Type 2 certified, and PCI DSS Level 1 certified for card data. Data processed in Canada and the United States, covered by a Data Processing Agreement (DPA).
• Amazon Web Services (Amazon SES) — Delivery of the Service's transactional emails (confirmations, notices, reminders) and of authentication emails (account confirmation, sign-in link, password reset). ca-central-1 (Montreal) region: emails and their delivery logs are processed in Quebec. SOC 2 Type 2 certified. Amazon Web Services, Inc. is a US company; processing stays in Canada and is covered by the AWS data processing agreement (DPA). This is the same link we already have indirectly, since Supabase's infrastructure also runs on AWS in Canada. Amazon also handles reception of emails sent to syndicate mailboxes, where that option is active: it receives the message, scans it for spam and malware, and places it temporarily, for at most 30 days, in encrypted storage in the same region, before we load it into our own database in Quebec. Amazon also forwards emails sent to postmaster@ and abuse@ at a syndicate address to CondoAide's operations mailbox, within the same region.
• Brevo — Marketing emails and management of our contact lists; also serves as the fallback relay for transactional emails when the primary send fails. European company, data covered by a GDPR-compliant DPA.
• Cloudflare (Turnstile) — Bot check on public forms (sign-in, sign-up, contact form, free tools): receives the IP address and technical data from the browser, never the content of a form or a document. Global network, outside Quebec.
• Anthropic — Artificial intelligence model, in the United States, used by the AI assistant, by the on-request reading of one of the syndicate's insurance policies, by the analysis, drafting and translation of texts, and by the declaration of co-ownership read when the rules of our analysis service cannot read an item; that read removes, before sending, the names of people it detects. No user identifier or account metadata is sent with a request, but the content sent may name the syndicate or people; Anthropic's commercial terms prohibit it from using them to train its models and, according to its published practices, it deletes them within 30 days, with the exceptions described in section 9 of our Privacy Policy.
• OVHcloud (self-hosted document embeddings) — Hosts our self-hosted embedding model (bge-m3): text from registre documents at every access level is converted into numeric vectors for authorized search. Access remains governed by the source document's classification; the AI assistant only searches documents open to co-owners, or to co-owners and tenants, that the person can read, never those reserved for the board. Beauharnois (Québec) region. Self-hosted software; no data leaves Québec.
• OVHcloud (self-hosted document analysis) — Hosts our analysis service for imported files (maintenance log, reserve fund study, the syndicate's bank account statement, a vendor invoice attached to a work order, the syndicate's declaration of co-ownership), which extracts the data to review before keeping it. It reads PDFs and, for an invoice, scanned images through optical character recognition. It also reads each proof of insurance filed or imported, including a photo, to extract the insurer, the policy number, the dates and the coverage amounts; reading them therefore uses no artificial intelligence service. The file is read during the analysis and then discarded by this service. For the declaration of co-ownership, the page text is kept in our database in Quebec while the read runs, then destroyed; only the resulting proposal, with the names of people removed, is kept. Beauharnois (Québec) region. Self-hosted software.
• OVHcloud (self-hosted OpenReplay) — Hosts our OpenReplay installation: product telemetry and session recording for technical support. Beauharnois (Québec) region. Self-hosted software — no data leaves Québec.
• OVHcloud (self-hosted GlitchTip) — Hosts our GlitchTip installation: tracking of errors, exceptions and application logs. Beauharnois (Québec) region. Self-hosted software — no data leaves Québec.
• OVHcloud (self-hosted Plausible) — Hosts our Plausible installation: cookieless, aggregate web analytics (visitors, pages viewed, traffic sources, city and country) on the public pages of the site. The IP address is used momentarily to determine the city, then immediately discarded; it is never stored. Beauharnois (Québec) region. Self-hosted software — no data leaves Québec.
• OVHcloud (self-hosted video-conferencing server) — Hosting for our video-conferencing server (LiveKit), which relays audio and video for assembly meetings held online. The stream passes through in real time and is not recorded: no meeting is retained, by us or by the host. Categories: participants' image and voice during the meeting, display name, connection timestamps. Location: Canada (Beauharnois, Quebec). Self-hosted software — LiveKit Inc. is not a sub-processor; the operational sub-processor is OVHcloud.
• iDrive e2 (off-site backups) — Storage of our backups: a copy of the database every four hours and a daily copy of uploaded files (registry documents, attachments). The backups retain the information entrusted to the Service. Vector search indexes and their processing queue are not copied because they are rebuilt from source files after a restore. Categories: every category described above. Retention: 30 days. Location: Canada (Montreal, Quebec).
• OVHcloud (secondary backup copy) — A second copy of the same backups, synchronised once a day from iDrive e2, so that the failure of a single provider cannot take the backups with it. Same categories and retention as iDrive e2. Location: Canada (Beauharnois, Quebec).
• OVHcloud (backup production) — Hosts the job that produces our backups: it reads the database every four hours and uploaded files once a day, encrypts the database copy on this server, then sends the copies to iDrive e2 and to the secondary copy. No backup is kept there. Beauharnois (Québec) region. Self-hosted software.
• In the event of an incident only: our insurer and the providers on its approved response panel may receive information for investigation, defence and notification purposes. They are not processors of the Service and receive nothing in the normal course.
• The complete, up-to-date list of sub-processors is in section 3 of our Privacy Policy.

7. Cookies and consent

On your first visit to the public site or to a sign-in page, a banner asks whether you accept product telemetry cookies. If you refuse, no analytics tool is loaded. Strictly necessary cookies (session, security, language) remain active regardless of your choice — they are essential to the operation of the service. Your choice is stored locally (localStorage) and can be changed at any time via the "Reset cookie preferences" link at the bottom of every page.

8. Telemetry and session recording

Our product telemetry and application error tracking are installations we operate ourselves on OVHcloud infrastructure in Montréal. No telemetry or error data leaves Québec.

• OpenReplay self-hosted on OVHcloud Montréal — product telemetry (usage events) and session recording for technical support.
• GlitchTip self-hosted on OVHcloud Montréal — captures errors, exceptions and application logs so we can fix bugs and trace incidents.
• Pseudonymization: the user identifier transmitted is an opaque hash-derived token; never your email, name, or Supabase ID.
• Aggressive masking (OpenReplay): form fields are masked automatically; screens containing sensitive information (PAD, attestation, registry, financial statements, insurance proofs, compliance, syndicate members, payments) are fully masked.
• Minimization (GlitchTip): request bodies (form data, authentication headers, cookies) are automatically dropped before storage. Only the exception trace, URL and technical metadata are kept.
• IP address: not transmitted to OpenReplay or GlitchTip.
• Retention: 30 days for all flows — events and session recordings on OpenReplay; application logs and error events on GlitchTip. Resolved GlitchTip issue groups are kept 90 days for regression detection.
• You can disable OpenReplay session recording at any time via Profile → Session recording for support. GlitchTip remains active independently, being strictly necessary for service quality and configured without direct personal information.
• Aggregate analytics (Plausible). To measure overall traffic on our public pages (visitors, pages, sources, city and country), we use a self-hosted Plausible installation on the same OVHcloud infrastructure in Montréal. Plausible sets no cookies, stores no persistent identifier, and captures no direct personal information. The IP address is used momentarily to determine the city, then immediately discarded; it is never stored. This measurement runs for all visitors regardless of your banner choice, because no personal information is involved. Retention: 24 months. See §3 of our Privacy Policy for details.

9. Questions or complaint

For any question about the security or privacy of your data, or to exercise one of your rights under Law 25:

• Privacy Officer: Nicolae Racovita
• Email: privacy@condoaide.ca
• Mailing address: CondoAide, 4143 chemin Ste-Angélique, Saint-Lazare (Quebec) J7T 2N5, Canada
• If you are not satisfied with how we handle your request or your complaint, you also have the right to file a complaint with the Commission d'accès à l'information du Québec: cai.gouv.qc.ca.