Security and hosting in Quebec

1. Where your data lives

All infrastructure that processes or hosts your association's data is located in Quebec:

• Web application: served by Vercel from the Montreal (yul1) region.
• Database and stored files: Supabase, ca-central-1 (Montreal) region.
• Email delivery and reception: Amazon SES, ca-central-1 (Montreal) region.
• Analysis of imported documents (maintenance log, reserve fund study, bank statement, vendor invoice): self-hosted service at OVHcloud, in Beauharnois (Quebec).
• Primary backups: kept in Quebec, in Montreal.
• Secondary backups: kept in Quebec, in Beauharnois, with a separate provider.
• Checking a contractor's RBQ licence: VériBât, another service of Solutions Nicvi inc. (the same company as CondoAide), running in the Montreal (yul1) region.
• Your condo association data (registry, finances, documents, communications, minutes) is not transferred outside Canada in normal operation of the service. Limited exceptions (subscription payments via Stripe, marketing emails and the fallback relay for transactional emails via Brevo in the European Union, explicitly opt-in AI features) are described in section 6 below and in section 9 of the Privacy Policy.

2. Encryption

Encryption happens at several levels, each with a specific role:

• Data at rest — AES-256 on the database, backups and stored files. Managed by the underlying infrastructure (AWS, which hosts Supabase's ca-central-1 region).
• Data in transit — TLS 1.3 between your browser, our application and our internal services.
• Passwords — Hashed with bcrypt. Hashing is one-way — your passwords are never stored in plain text, never reversible, and no one at CondoAide (including administrators) can read them. This is intentional and is the correct practice.
• Authentication tokens (JWT) — Cryptographically signed with ECDSA on the P-256 curve (ES256). The signature is asymmetric: the key that signs tokens is never shared with the services that verify them, and a token cannot be tampered with without detection.

3. Quebec Law 25 compliance

Since 2023, Quebec Law 25 (An Act to modernize legislative provisions as regards the protection of personal information) places direct obligations on condo associations, which are responsible for the personal information of their unit owners. CondoAide is designed to help you meet these obligations without extra paperwork:

• Designated Privacy Officer publicly named at CondoAide — see section 7 of our Privacy Policy.
• Governance policies and practices adopted on July 30, 2026 — incident response procedure, incident register, complaints handling procedure and retention schedule. The public summary is on our Governance page.
• Internal incident registry maintained, with a commitment to notify Quebec's Commission d'accès à l'information within 72 hours of confirming a risk-bearing incident.
• Data retention and destruction policy with specific timelines per data category — see section 5 of our Privacy Policy.
• Right of access and rectification: each unit owner can view and correct their personal information through the platform or by contacting the Privacy Officer.
• Hosted in Quebec: in our assessment, hosting the application, the database and email delivery in Quebec does not constitute a transfer outside Quebec within the meaning of Law 25. The contractually governed flows that do leave Quebec (subscription billing, marketing emails and the fallback relay for transactional emails, explicitly enabled AI features) are listed in section 6.

4. Access and audit logging

Access to your association's data is strictly controlled:

• Granular permissions: board administrators, unit owners and residents have distinct access levels defined by your declaration of co-ownership.
• Strong authentication: two-factor authentication (2FA) is available for all accounts.
• Audit log: every sensitive action (viewing financial documents, modifying the registry, generating certificates) is logged and timestamped.
• CondoAide staff access: limited to people with a specific operational need (technical support, troubleshooting), logged, and subject to confidentiality agreements.

5. Backups and business continuity

Your association cannot afford to lose its registry, minutes or maintenance log. Our backup strategy follows the industry standard 3-2-1 principle (three copies, two media, one offsite):

• Supabase backups: point-in-time recovery over 7 days plus daily snapshots.
• Additional backups in Quebec — Montreal: database backups every 4 hours and storage files daily, kept 30 days.
• Additional backups in Quebec — Beauharnois: daily mirror copy at a second distinct Quebec provider, for geographic resilience.

6. Sub-processors

CondoAide relies on a small number of specialized providers. All are contractually bound to confidentiality and personal-information protections equivalent to those Quebec law requires. For the main sub-processors:

• Vercel — Hosting of the web application, Montreal (yul1) region. SOC 2 Type 2 certified.
• Supabase — PostgreSQL database, authentication, file storage. ca-central-1 (Montreal) region. SOC 2 Type 2 certified.
• Stripe — Two uses: (1) payment of your CondoAide subscription (credit card, PAD) and (2) automatic condo-fee collection by pre-authorized debit (PAD/ACSS) — the banking information of co-owners who enable the debit is processed by Stripe, which then deposits the funds directly into the syndicate's account (Stripe Payments Canada, Ltd., operating under Payments Canada rules). SOC 2 Type 2 certified, and PCI DSS Level 1 certified for card data. Data processed in the United States, covered by a Data Processing Agreement (DPA).
• Amazon Web Services (Amazon SES) — Delivery of the Service's transactional emails (confirmations, notices, reminders) and of authentication emails (account confirmation, sign-in link, password reset). ca-central-1 (Montreal) region: emails and their delivery logs are processed in Quebec. SOC 2 Type 2 certified. Amazon Web Services, Inc. is a US company; processing stays in Canada and is covered by the AWS data processing agreement (DPA). This is the same link we already have indirectly, since Supabase's infrastructure also runs on AWS in Canada. Amazon also handles reception of emails sent to syndicate mailboxes, where that option is active: it receives the message, scans it for spam and malware, and places it temporarily, for at most 30 days, in encrypted storage in the same region, before we load it into our own database in Quebec. Amazon also forwards emails sent to postmaster@ and abuse@ at a syndicate address to CondoAide's operations mailbox, within the same region.
• Brevo — Marketing emails and management of our contact lists; also serves as the fallback relay for transactional emails when the primary send fails. European company, data covered by a GDPR-compliant DPA.
• Anthropic — AI model used only for opt-in AI features (Law 16 assistant, insurance policy extraction). No data is sent to this provider if you do not enable these features. See section 9 of our Privacy Policy.
• OVHcloud (self-hosted document embeddings) — Hosts our self-hosted embedding model (bge-m3): text from registre documents at every access level is converted into numeric vectors for authorized search. Access remains governed by the source document's classification; the AI assistant searches only documents shared with all co-owners. Beauharnois (Québec) region. Self-hosted software; no data leaves Québec.
• OVHcloud (self-hosted document analysis) — Hosts our analysis service for imported files (maintenance log, reserve fund study, the syndicate's bank account statement, a vendor invoice attached to a work order), which extracts the data to review before keeping it. It reads PDFs and, for an invoice, scanned images through optical character recognition. The file is read during the analysis and then discarded by this service. Beauharnois (Québec) region. Self-hosted software.
• OVHcloud (self-hosted OpenReplay) — Hosts our OpenReplay installation: product telemetry and session recording for technical support. Beauharnois (Québec) region. Self-hosted software — no data leaves Québec.
• OVHcloud (self-hosted GlitchTip) — Hosts our GlitchTip installation: tracking of errors, exceptions and application logs. Beauharnois (Québec) region. Self-hosted software — no data leaves Québec.
• OVHcloud (self-hosted Plausible) — Hosts our Plausible installation: cookieless, aggregate web analytics (visitors, pages viewed, traffic sources, city and country) on the public pages of the site. The IP address is used momentarily to determine the city, then immediately discarded; it is never stored. Beauharnois (Québec) region. Self-hosted software — no data leaves Québec.
• OVHcloud (self-hosted video-conferencing server) — Hosting for our video-conferencing server (LiveKit), which relays audio and video for assembly meetings held online. The stream passes through in real time and is not recorded: no meeting is retained, by us or by the host. Categories: participants' image and voice during the meeting, display name, connection timestamps. Location: Canada (Beauharnois, Quebec). Self-hosted software — LiveKit Inc. is not a sub-processor; the operational sub-processor is OVHcloud.
• iDrive e2 (off-site backups) — Storage of our backups: a copy of the database every four hours and a daily copy of uploaded files (registry documents, attachments). The backups retain the information entrusted to the Service. Vector search indexes and their processing queue are not copied because they are rebuilt from source files after a restore. Categories: every category described above. Retention: 30 days. Location: Canada (Montreal, Quebec).
• OVHcloud (secondary backup copy) — A second copy of the same backups, synchronised once a day from iDrive e2, so that the failure of a single provider cannot take the backups with it. Same categories and retention as iDrive e2. Location: Canada (Beauharnois, Quebec).
• OVHcloud (backup production) — Hosts the job that produces our backups: it reads the database every four hours and uploaded files once a day, encrypts the database copy on this server, then sends the copies to iDrive e2 and to the secondary copy. No backup is kept there. Beauharnois (Québec) region. Self-hosted software.
• In the event of an incident only: our insurer and the providers on its approved response panel may receive information for investigation, defence and notification purposes. They are not processors of the Service and receive nothing in the normal course.
• The complete, up-to-date list of sub-processors is in section 3 of our Privacy Policy.

7. Cookies and consent

On your first visit to the public site or to a sign-in page, a banner asks whether you accept product telemetry cookies. If you refuse, no analytics tool is loaded. Strictly necessary cookies (session, security, language) remain active regardless of your choice — they are essential to the operation of the service. Your choice is stored locally (localStorage) and can be changed at any time via the "Reset cookie preferences" link at the bottom of every page.

8. Telemetry and session recording

Our product telemetry and application error tracking are installations we operate ourselves on OVHcloud infrastructure in Montréal. No telemetry or error data leaves Québec.

• OpenReplay self-hosted on OVHcloud Montréal — product telemetry (usage events) and session recording for technical support.
• GlitchTip self-hosted on OVHcloud Montréal — captures errors, exceptions and application logs so we can fix bugs and trace incidents.
• Pseudonymization: the user identifier transmitted is an opaque hash-derived token; never your email, name, or Supabase ID.
• Aggressive masking (OpenReplay): form fields are masked automatically; screens containing sensitive information (PAD, attestation, registry, financial statements, insurance proofs, compliance, syndicate members, payments) are fully masked.
• Minimization (GlitchTip): request bodies (form data, authentication headers, cookies) are automatically dropped before storage. Only the exception trace, URL and technical metadata are kept.
• IP address: not transmitted to OpenReplay or GlitchTip.
• Retention: 30 days for all flows — events and session recordings on OpenReplay; application logs and error events on GlitchTip. Resolved GlitchTip issue groups are kept 90 days for regression detection.
• You can disable OpenReplay session recording at any time via Profile → Session recording for support. GlitchTip remains active independently, being strictly necessary for service quality and configured without direct personal information.
• Aggregate analytics (Plausible). To measure overall traffic on our public pages (visitors, pages, sources, city and country), we use a self-hosted Plausible installation on the same OVHcloud infrastructure in Montréal. Plausible sets no cookies, stores no persistent identifier, and captures no direct personal information. The IP address is used momentarily to determine the city, then immediately discarded; it is never stored. This measurement runs for all visitors regardless of your banner choice, because no personal information is involved. Retention: 24 months. See §3 of our Privacy Policy for details.

9. Questions or complaint

For any question about the security or privacy of your data, or to exercise one of your rights under Law 25:

• Privacy Officer: Nicolae Racovita
• Email: privacy@condoaide.ca
• Mailing address: CondoAide, 4143 chemin Ste-Angélique, Saint-Lazare (Quebec) J7T 2N5, Canada
• If you are not satisfied with how we handle your request or your complaint, you also have the right to file a complaint with the Commission d'accès à l'information du Québec: cai.gouv.qc.ca.