Your data stays in Canada, under your control

Hosted in Canada

• The application and the database run in a data centre in Montreal, in the Canada (Central) region. Backups are kept in the same region.
• The database cannot be reached from the internet, and the server exposes only its web and administration ports.
• InfoTimes is a company registered in Canada and is subject to Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).

Encryption

• Every connection to the platform and its API uses HTTPS with automatically renewed certificates, and browsers are told to use HTTPS only.
• Tokens for accounts connected through official APIs, two-step verification secrets and webhook signing secrets are encrypted in the database.
• Passwords are hashed with scrypt. Session tokens, API keys, share links and recovery codes are stored only as one-way hashes.

Access control

• Five roles, from owner to read-only client, with members limited to specific workspaces and projects.
• Two-step verification, IP allowlists, an idle session timeout, and invitations limited to your organization’s email domains.
• Every user can see their active sessions and end them remotely. Sessions end as soon as a member is removed or a password is changed.
• Each organization’s data is isolated in every query. The activity log records sign-ins, role changes, exports and changes to sensitive settings.

Retention and deletion

• Your organization sets how long collected content is kept, in the data vault. Older content is deleted automatically, except items cited in approved reports.
• Deleted automatically: items the filter excluded after 30 days, deleted projects and runs after 30 days, exports after 7 days, assistant conversations after 30 days.
• Nightly database backups are kept for about two months at most, and daily server snapshots for 7 days.
• You can export all your data at any time. At the end of the contract the data is deleted, and its backups expire on the same schedule.

Artificial intelligence

• Language models classify and summarize content. Every label shows its confidence, your team can correct it, and each correction is logged.
• Client data is not used to train models, and a team’s corrections are used only in that team’s own project.
• The assistant runs on a model that keeps requests in Canada, and classification and summaries can be limited to Canada for organizations that require it.
• The platform never posts on your behalf. Replies, statements and reports stay drafts until your team approves them.

Service providers

InfoTimes uses specialist providers that process data on its behalf and on its instructions. These are their categories and where they process data:

Provider names and locations are listed in the hosting statement and in the annex to the data processing agreement. Clients under contract are told in advance about any new provider that will process their data.