Security and hosting in Quebec

1. Where your data lives

The infrastructure that hosts your association's data is located in Quebec:

• Web application: served by Vercel from the Montreal (yul1) region.
• Database and stored files: Supabase, ca-central-1 (Montreal) region.
• Email delivery and reception: Amazon SES, ca-central-1 (Montreal) region.
• Condo-fee debits: Zūm Rails, AWS ca-central-1 (Montreal) region; our agreement prohibits it from processing the information we send it outside Québec without our prior written approval.
• Analysis of imported documents (maintenance log, reserve fund study, bank statement, vendor invoice, declaration of co-ownership): self-hosted service at OVHcloud, in Beauharnois (Quebec).
• Antivirus scan of imported attachments: self-hosted service at OVHcloud, in Beauharnois (Quebec).
• Video conferencing, recording and transcription of meetings: self-hosted server at OVHcloud and files in OVHcloud Object Storage, in Beauharnois (Quebec); the optional artificial intelligence summary is produced on the same server; nothing from a meeting leaves Quebec.
• Mobile app notifications: a notice that contains only a generic text and three technical identifiers passes through Expo, in the United States, then through Apple's or Google's notification service, outside Québec.
• Connected calendars: when a board member or a member of a management company’s staff connects their own Google or Microsoft calendar, CondoAide asks that provider, in the United States, only for the times the person is busy; the authorization token is stored encrypted in the database in Québec, and busy times are kept only about 5 minutes.
• Copy of the archives into the syndicate’s OneDrive (on its board of directors’ decision): every week, CondoAide writes the complete copy of the syndicate’s archives into a reserved folder of the OneDrive account the account owner connected; Microsoft decides where that account is hosted, possibly outside Quebec, and that copy is under the responsibility of the syndicate, which chose it (section 9 of the Privacy Policy). The authorization token is stored encrypted in the database in Quebec and destroyed on disconnection.
• Mail import from a Microsoft account (at a board member’s request): during the import, CondoAide reads the chosen folders of the Microsoft account of the syndicate’s previous address, hosted where Microsoft decides, possibly outside Quebec, and adds the emails to the syndicate’s mailbox, in Quebec. The authorization token is kept encrypted in the database in Quebec and destroyed as soon as the import ends, for whatever reason.
• Primary backups: kept in Quebec, in Montreal.
• Secondary backups: kept in Quebec, in Beauharnois, with a separate provider.
• Checking a contractor's RBQ licence: VériBât, another service of Solutions Nicvi inc. (the same company as CondoAide), running in the Montreal (yul1) region.
• Bot check on public forms (sign-in, sign-up, contact form, free tools): Cloudflare Turnstile, on Cloudflare's global network, outside Quebec; it receives technical data from the browser, never the content of a form or a document.
• Your condo association data (registry, finances, documents, communications, minutes) is hosted in Canada. Some of it is sent outside Canada: subscription payments via Stripe, which also keeps the condo-fee debit mandates set up with Stripe before the move to Zūm Rails, marketing emails and the fallback relay for transactional emails via Brevo in the European Union, Anthropic's artificial intelligence features in the United States, Cloudflare's bot check (Turnstile) on its global network, and the busy-time check of a Google or Microsoft calendar that a person chooses to connect, in the United States. To these is added, on a syndicate’s board of directors’ decision, the weekly copy of its archives into the OneDrive account it connects itself, hosted where Microsoft decides: that copy is the syndicate’s, under its responsibility. These cases are described in section 6 below and in section 9 of the Privacy Policy.
• In addition, when a board member connects the Microsoft account of the syndicate’s previous address to import its mail, that account is read at Microsoft, hosted where Microsoft decides, possibly outside Quebec, for the duration of the import (section 9 of the Privacy Policy).

2. Encryption

Encryption happens at several levels, each with a specific role:

• Data at rest — AES-256 on the database, backups and stored files. Managed by the underlying infrastructure (AWS, which hosts Supabase's ca-central-1 region).
• Data in transit — TLS 1.3 between your browser, our application and our internal services.
• Passwords — Hashed with bcrypt. Hashing is one-way — your passwords are never stored in plain text, never reversible, and no one at CondoAide (including administrators) can read them. This is intentional and is the correct practice.
• Authentication tokens (JWT) — Cryptographically signed with ECDSA on the P-256 curve (ES256). The signature is asymmetric: the key that signs tokens is never shared with the services that verify them, and a token cannot be tampered with without detection.

3. Quebec Law 25

Since 2023, Quebec Law 25 (An Act to modernize legislative provisions as regards the protection of personal information) places direct obligations on condo associations, which are responsible for the personal information of their unit owners. Here are the measures CondoAide has put in place:

• Designated Privacy Officer publicly named at CondoAide — see section 7 of our Privacy Policy.
• Governance policies and practices adopted on July 30, 2026 — incident response procedure, incident register, complaints handling procedure and retention schedule. The public summary is on our Governance page.
• Internal incident registry maintained, with a commitment to notify Quebec's Commission d'accès à l'information within 72 hours of confirming a risk-bearing incident.
• Data retention and destruction policy with specific timelines per data category — see section 5 of our Privacy Policy.
• Right of access and rectification: each unit owner can view and correct their personal information through the platform or by contacting the Privacy Officer.
• Hosted in Quebec: in our assessment, hosting the application, the database and email delivery in Quebec does not constitute a transfer outside Quebec within the meaning of Law 25. The contractually governed flows that do leave Quebec (subscription billing and the condo-fee debit mandates set up with Stripe before the move to Zūm Rails, marketing emails and the fallback relay for transactional emails, artificial intelligence features, bot check on public forms) are listed in section 6. The busy-time check of a Google or Microsoft calendar, which a person chooses to connect themselves, also leaves Quebec (section 6). The weekly copy of a syndicate’s archives into the OneDrive account its board of directors connects itself is the syndicate’s communication, not ours: Microsoft decides its location, and the assessment required by section 17 is the syndicate’s, which the connection screen says (section 1).
• Mobile app notifications: the notice passes through Expo, in the United States, then through Apple or Google, outside Québec (section 6); it contains only a generic text and three technical identifiers.

4. Access and audit logging

Access to your association's data is strictly controlled:

• Granular permissions: board administrators, unit owners and residents have distinct access levels defined by your declaration of co-ownership.
• Strong authentication: a second factor is available for all accounts, through an authenticator app or a device key (Touch ID, Face ID, security key). Biometric verification happens on your device: your fingerprint or face is never sent to us, and we receive only a public key and a signature. A key synced by your password manager (iCloud Keychain, Google, 1Password) is also kept, encrypted, by that provider, possibly outside Québec; CondoAide sends it nothing.
• Audit log: every sensitive action (viewing financial documents, modifying the registry, generating certificates) is logged and timestamped.
• Booking links: the link a board member passes on to book a meeting with them carries a random code. It shows only their open times, never the title or details of their events. Each booking is checked again by our servers when it is confirmed, the number of requests is limited, and the member can turn the link off or replace it at any time. These pages are not indexed by search engines.
• CondoAide staff access: limited to people with a specific operational need (technical support, troubleshooting) and subject to confidentiality agreements. To see a syndicate's personal information in the administration console (member list, signatories' identity, the syndicate's documents), staff must open access by giving a reason or a request reference; that access lasts at most two hours, and every consultation is recorded in a log that no one can modify or erase. A report sent to support is read by staff to answer it. Staff can no longer sign in as a real user.

5. Backups and business continuity

Your association cannot afford to lose its registry, minutes or maintenance log. Our backup strategy follows the industry standard 3-2-1 principle (three copies, two media, one offsite):

• Supabase backups: daily snapshots of the database.
• Additional backups in Quebec — Montreal: database backups every 4 hours and storage files daily, kept 30 days.
• Additional backups in Quebec — Beauharnois: daily mirror copy at a second distinct Quebec provider, for geographic resilience.
• Service continuity: our commitments should CondoAide cease operating (notice, read-only access, delivery of the complete archive) are published on the Service continuity page, and the complete archive can be downloaded at any time in the syndicate’s settings.

6. Sub-processors

CondoAide relies on a small number of specialized providers. Those that process information on our behalf are contractually bound to confidentiality and personal-information protections equivalent to those Quebec law requires. Services the person chooses themselves, such as their browser’s notification service or their Google or Microsoft calendar, do not act on our behalf and have no data processing agreement with CondoAide; their description says so. For the main sub-processors:

• Vercel — Hosting of the web application, Montreal (yul1) region. SOC 2 Type 2 certified.
• Supabase — PostgreSQL database, authentication, file storage. ca-central-1 (Montreal) region. SOC 2 Type 2 certified.
• Stripe — Payment of your CondoAide subscription (credit card, PAD). Stripe also keeps, on the syndicates' behalf, the mandates and condo-fee debit history set up with Stripe before condo-fee collection moved to Zūm Rails. SOC 2 Type 2 certified, and PCI DSS Level 1 certified for card data. Data processed in Canada and the United States, covered by a Data Processing Agreement (DPA).
• Zūm Rails — Automatic condo-fee collection by pre-authorized debit (PAD): Zūm Rails debits the fees from the co-owner's account, deposits them in the syndicate's wallet at Zūm Rails and pays them into the syndicate's bank account. The co-owner enters their banking details directly in Zūm Connect, Zūm Rails' interface, and CondoAide does not receive them; consent to the mandate, for its part, is collected and kept by CondoAide on the syndicate's behalf. The information we send it is processed in Québec, in the AWS ca-central-1 (Montreal) region, covered by a written agreement that prohibits any transfer outside Québec without our prior written approval.
• Mandate signed on paper: CondoAide sends Zūm Rails the institution, transit and account numbers the co-owner wrote on the mandate, without recording them in its systems; CondoAide keeps the scanned copy of the mandate and of the void cheque or letter from the financial institution in Québec.
• Amazon Web Services (Amazon SES) — Delivery of the Service's transactional emails (confirmations, notices, reminders) and of authentication emails (account confirmation, sign-in link, password reset). ca-central-1 (Montreal) region: emails and their delivery logs are processed in Quebec. SOC 2 Type 2 certified. Amazon Web Services, Inc. is a US company; processing stays in Canada and is covered by the AWS data processing agreement (DPA). This is the same link we already have indirectly, since Supabase's infrastructure also runs on AWS in Canada. Amazon also handles reception of emails sent to syndicate mailboxes, where that option is active: it receives the message, scans it for spam and malware, and places it temporarily, for at most 30 days, in encrypted storage in the same region, before we load it into our own database in Quebec. Amazon also forwards emails sent to postmaster@ and abuse@ at a syndicate address to CondoAide's operations mailbox, within the same region.
• Brevo — Marketing emails and management of our contact lists; also serves as the fallback relay for transactional emails when the primary send fails. European company, data covered by a GDPR-compliant DPA.
• Cloudflare (Turnstile) — Bot check on public forms (sign-in, sign-up, contact form, free tools): receives the IP address and technical data from the browser, never the content of a form or a document. Global network, outside Quebec.
• Anthropic — Artificial intelligence model, in the United States, used by the AI assistant, by the on-request reading of one of the syndicate's insurance policies, by the analysis, drafting and translation of texts, by the reply drafts CondoAide's team prepares from a report sent to support, by the reading of a water heater's rating plate photographed by the board of directors or by the co-owner of the private portion, and by the declaration of co-ownership read when the rules of our analysis service cannot read an item; that read removes, before sending, the names of people it detects. When the table of fractions remains unreadable, an authorized board member may also send it, after previewing it, the image of one page of that table, cropped in Quebec to the region of the table only, reduced and without metadata; the declaration file itself is never transmitted. No user identifier or account metadata is sent with a request, but the content sent may name the syndicate or people; Anthropic's commercial terms prohibit it from using them to train its models and, according to its published practices, it deletes them within 30 days, with the exceptions described in section 9 of our Privacy Policy.
• OVHcloud (self-hosted document embeddings) — Hosts our self-hosted embedding model (bge-m3): text from registre documents at every access level is converted into numeric vectors for authorized search. Access remains governed by the source document's classification; the AI assistant only searches documents open to co-owners, or to co-owners and tenants, that the person can read, never those reserved for the board. Beauharnois (Québec) region. Self-hosted software; no data leaves Québec.
• OVHcloud (self-hosted document analysis) — Hosts our analysis service for imported files (maintenance log, reserve fund study, the syndicate's bank account statement, a vendor invoice attached to a work order, the syndicate's declaration of co-ownership), which extracts the data to review before keeping it. It reads PDFs and, for an invoice, scanned images through optical character recognition. It also reads each proof of insurance filed or imported, including a photo, to extract the insurer, the policy number, the dates and the coverage amounts; reading them therefore uses no artificial intelligence service. For a mandate signed on paper, it also reads the numbers printed at the bottom of the void cheque, which the person recording the mandate confirms. The file is read during the analysis and then discarded by this service. For the declaration of co-ownership, the page text is kept in our database in Quebec while the read runs, then destroyed; only the resulting proposal, with the names of people removed, is kept. Beauharnois (Québec) region. Self-hosted software.
• OVHcloud (self-hosted antivirus) — Hosts our self-hosted antivirus (ClamAV), which scans every attachment of an email imported into the syndicate's mailbox from its previous address, before it can be opened. The file is read during the scan and then discarded by this service; only the result is kept. Beauharnois region (Quebec). Self-hosted software.
• OVHcloud (self-hosted OpenReplay) — Hosts our OpenReplay installation: product telemetry and session recording for technical support. Beauharnois (Québec) region. Self-hosted software — no data leaves Québec.
• OVHcloud (self-hosted GlitchTip) — Hosts our GlitchTip installation: tracking of errors, exceptions and application logs. Beauharnois (Québec) region. Self-hosted software — no data leaves Québec.
• OVHcloud (self-hosted Plausible) — Hosts our Plausible installation: cookieless, aggregate web analytics (visitors, pages viewed, traffic sources, city and country) on the public pages of the site. The IP address is used momentarily to determine the city, then immediately discarded; it is never stored. Beauharnois (Québec) region. Self-hosted software — no data leaves Québec.
• OVHcloud (self-hosted video-conferencing server) — Hosting for our video-conferencing server (LiveKit), which relays audio and video for assembly meetings, board meetings and meetings held online in CondoAide. A meeting is recorded only if the board of directors decided so for that meeting, and only the people who consent are recorded, each on their own tracks: their voice and, when the syndicate’s plan includes it, their image and shared screen; a person who refuses is in no file (section 1 of the privacy policy). In a meeting held online, it also relays the meeting's chat messages, in real time and without keeping them. Categories: participants’ image and voice during the meeting, display name, connection timestamps, chat messages of a meeting, while in transit; for a recorded meeting, the voice and, where applicable, the image and shared screen of the people who consented. Location: Canada (Beauharnois, Quebec). Self-hosted software - LiveKit Inc. is not a sub-processor; the operational sub-processor is OVHcloud.
• OVHcloud (self-hosted meeting recording, transcription and summary) — Hosting, on the same server as the video conference, of meeting recording, transcription and the optional summary. After the meeting, the tracks of the people who consented are combined into one listening file, then transcribed by a speech recognition model (Whisper) that we run ourselves; each passage is attributed to the signed-in person it comes from, never by recognizing their voice. No voiceprint is computed or kept. Image and screen tracks are never analyzed (no recognition, no detection, no extraction of their content): they are only re-encoded, that is decoded and compressed again, so that the replay can move to any moment, and cut before a secret vote or after a consent withdrawal. When the syndicate has chosen artificial intelligence summaries, an open-weight language model we run on the same server drafts a summary of each agenda item of an assembly meeting or a board of directors meeting, or a summary of a meeting held in CondoAide, using only the words of the people who agreed to it separately; a room microphone is never used, and only a vote’s totals are given to it. Only the board of directors and, if there is one, the syndicate’s manager read these summaries; they review an assembly or board meeting’s summary before using it in the minutes. Categories: voice and, where applicable, image and shared screen of the people who consented, text of what they said, display name, summary. Location: Canada (Beauharnois, Quebec). Self-hosted software - no data leaves Quebec.
• OVHcloud Object Storage (recording files) — Storage of the audio and, where applicable, video (image and shared screen) files of recorded meetings, in private storage spaces. A file is read only through a short-lived link, issued after checking that the person may listen to it, and each listening is logged (one line each time a person starts playback from the page, even if playback restarts several times). Files are destroyed on the periods in section 5 of the privacy policy and are not copied into our backups. Categories: voice and, where applicable, image and shared screen of the people who consented to the recording. Location: Canada (Beauharnois, Quebec).
• Expo, with Apple and Google (mobile app notifications) — Expo hands the mobile app's notifications to Apple's (APNs) or Google's (Firebase Cloud Messaging) service, its subprocessors for that delivery. They receive the phone's token and a readable notice, limited to a generic text and three technical identifiers (category, syndicate, item concerned). United States.
• Google and Microsoft (connected calendars) — Only if a board member or a member of a management company’s staff connects their own calendar: they receive the authorization token, the identifiers of the calendars chosen and the period to check, and return only busy times, with no title, location or attendees. The token is stored encrypted in the database in Québec; busy times are kept about 5 minutes. They do not act on our behalf: each handles this information as an independent controller, under its own terms, with no data processing agreement with CondoAide. Outside Québec. Companies based in the United States.
• iDrive e2 (off-site backups) — Storage of our backups: a copy of the database every four hours and a daily copy of uploaded files (registry documents, attachments). The backups retain the information entrusted to the Service. Vector search indexes and their processing queue are not copied because they are rebuilt from source files after a restore. Categories: every category described above. Retention: 30 days. Location: Canada (Montreal, Quebec).
• OVHcloud (secondary backup copy) — A second copy of the same backups, synchronised once a day from iDrive e2, so that the failure of a single provider cannot take the backups with it. Same categories and retention as iDrive e2. Location: Canada (Beauharnois, Quebec).
• OVHcloud (backup production) — Hosts the job that produces our backups: it reads the database every four hours and uploaded files once a day, encrypts the database copy on this server, then sends the copies to iDrive e2 and to the secondary copy. No backup is kept there. Beauharnois (Québec) region. Self-hosted software.
• In the event of an incident only: our insurer and the providers on its approved response panel may receive information for investigation, defence and notification purposes. They are not processors of the Service and receive nothing in the normal course.
• The complete, up-to-date list of sub-processors is in section 3 of our Privacy Policy.

7. Cookies and consent

On your first visit to the public site or to a sign-in page, a banner asks whether you accept product telemetry cookies. If you refuse, no analytics tool is loaded. Strictly necessary cookies (session, security, language) remain active regardless of your choice — they are essential to the operation of the service. Your choice is stored locally (localStorage) and can be changed at any time via the "Reset cookie preferences" link at the bottom of every page.

8. Telemetry and session recording

Our product telemetry and application error tracking are installations we operate ourselves on OVHcloud infrastructure in Montréal. No telemetry or error data leaves Québec.

• OpenReplay self-hosted on OVHcloud Montréal — product telemetry (usage events) and session recording for technical support.
• GlitchTip self-hosted on OVHcloud Montréal — captures errors, exceptions and application logs so we can fix bugs and trace incidents.
• Pseudonymization: the user identifier transmitted is an opaque hash-derived token; never your email, name, or Supabase ID.
• Aggressive masking (OpenReplay): form fields are masked automatically; screens containing sensitive information (PAD, attestation, registry, financial statements, insurance proofs, compliance, syndicate members, payments) are fully masked.
• Minimization (GlitchTip): request bodies (form data, authentication headers, cookies) are automatically dropped before storage. Only the exception trace, URL and technical metadata are kept.
• IP address: not transmitted to OpenReplay or GlitchTip.
• Retention: 30 days for all flows — events and session recordings on OpenReplay; application logs and error events on GlitchTip. Resolved GlitchTip issue groups are kept 90 days for regression detection.
• You can disable OpenReplay session recording at any time via Profile → Session recording for support. GlitchTip remains active independently, being strictly necessary for service quality and configured without direct personal information.
• Aggregate analytics (Plausible). To measure overall traffic on our public pages (visitors, pages, sources, city and country), we use a self-hosted Plausible installation on the same OVHcloud infrastructure in Montréal. Plausible sets no cookies, stores no persistent identifier, and captures no direct personal information. The IP address is used momentarily to determine the city, then immediately discarded; it is never stored. This measurement runs for all visitors regardless of your banner choice, because no personal information is involved. Retention: 24 months. See §3 of our Privacy Policy for details.

9. Video conferencing and meeting recordings

Assembly meetings, board meetings and meetings held online in CondoAide run through our own video-conferencing server. No outside video-conferencing service receives participants' image or voice.

• What is transmitted: your camera image, your voice, the screen you choose to share and your display name, relayed in real time only to the people admitted to the same meeting.
• You decide what is broadcast: your microphone is off when you arrive, you can join without your camera, and you can turn either off, or stop sharing your screen, at any time. Background blur is applied in your browser, before the image is sent.
• Where: self-hosted LiveKit server at OVHcloud, in Beauharnois (Quebec), together with the relay that helps a connection get through a firewall. LiveKit Inc., which publishes this open-source software, receives nothing and is not a sub-processor; OVHcloud hosts the server (section 6).
• Encryption: the connection to the server is encrypted (TLS), and image and voice are encrypted between your browser and the server (DTLS-SRTP). The server decrypts them to relay them to the other participants: this is not end-to-end encryption.
• Without a recording, nothing is kept: image, voice and shared screens only pass through. We keep only, for an assembly meeting, the times of connections and disconnections (attendance log) and the chat messages, and, for a meeting held in CondoAide, guests' names and the decision to admit them, for the periods in section 5 of the Privacy Policy. The server's technical logs contain only identifiers, never image or voice.
• Recording, on the board's decision: a meeting is recorded only if the board of directors decides so for that meeting, and the entry screen says so. Only the people who consent are recorded, each on their own tracks: their voice and, when the syndicate’s plan includes it, their image while their camera is on and the screen they share; declining does not prevent anyone from attending, speaking or voting. A shared screen is never recorded during a secret vote, and no face analysis is done.
• Transcript and optional summary: after the meeting, the tracks are transcribed by a speech-recognition model we run on the same server; no voiceprint is computed. If the syndicate chose it, a language model run on that same server also drafts a summary, using only the words of the people who separately agreed to it. For an assembly meeting or a board of directors meeting, it summarizes each agenda item; the board of directors and, if there is one, the syndicate’s manager review that summary before using it in the minutes. For a meeting held in CondoAide, it summarizes the meeting, and only the board of directors and, if there is one, the syndicate’s manager can read that summary. No recording is used to train a model.
• Storage and playback: files are kept in a private OVHcloud storage space in Beauharnois (Quebec) and are not copied into our backups. Playback goes through a short-lived link, issued after checking that the person may listen, and every playback is logged.
• Retention: for an assembly meeting, 90 days after the meeting, or until the minutes are sent if that comes later, and at most 180 days; if the board announced it in the notice of meeting, until the minutes are adopted at the next assembly, and at most 13 months. For a board meeting, 90 days. For a meeting held in CondoAide, 30 days, except the transcript and summary the board files with the work order or request it dealt with. A meeting's summary is destroyed as soon as the minutes are sent. A legal hold decided because of a dispute suspends destruction. The details are in section 5 of the Privacy Policy.
• Your rights: you can withdraw your consent at any time during the meeting, obtain a copy of the recording of your voice or its transcript, and ask for your track to be deleted (section 6 of the Privacy Policy).

10. Questions or complaint

For any question about the security or privacy of your data, or to exercise one of your rights under Law 25:

• Privacy Officer: Nicolae Racovita
• Email: privacy@condoaide.ca
• Mailing address: CondoAide, 4143 chemin Ste-Angélique, Saint-Lazare (Quebec) J7T 2N5, Canada
• If you are not satisfied with how we handle your request or your complaint, you also have the right to file a complaint with the Commission d'accès à l'information du Québec: cai.gouv.qc.ca.