Data Security and Privacy

• Data hosted on secure cloud infrastructure located in Montreal, Canada (northamerica-northeast1 region)
• AI processing (dimension extraction) also performed in Montreal (Google Vertex AI) — extraction data never leaves Canada
• Vertex AI chosen for its performance and enterprise commitment: your data is never used to train models (Google Cloud contractual commitment)
• Hosting compliant with Quebec and Canadian data localization requirements
• Strict data isolation between each client company
• Access limited to authorized users according to their roles
• Data encryption in transit and at rest according to industry standards
• Hash-chained audit trail: every sensitive action is logged in a tamper-evident registry, making any alteration detectable
• Hosting infrastructure certified SOC 2 and ISO 27001/27017/27018 (Google Cloud)
• Regular backups with controlled recovery mechanisms

Astérion Solutions inc. applies principles and obligations from:

• Quebec's Law 25 on the protection of personal information
• Applicable Canadian laws on privacy and data protection

These principles include:

• Limiting access to information
• Protection against unauthorized access
• Secure data storage
• Respect for the rights of individuals and organizations

Each client company has a separate data space guaranteeing:

• No interconnection between organizations
• No cross-access possible
• Strict logical separation of environments

We rely on recognized technical sub-processors, bound by the same confidentiality obligations. In accordance with section 17 of Quebec's Law 25, a privacy impact assessment was carried out for each of the communications outside Quebec listed below; its summary, the full sub-processor register and a data processing agreement are available on request:

• Google Cloud / Firebase — hosting, storage and AI processing (Vertex AI), Montreal region (Canada). Infrastructure certified SOC 2 and ISO 27001/27017/27018
• Stripe — secure payment processing (no card data stored on our servers) — United States
• Amazon SES (Amazon Web Services) — transactional email delivery (invitations, notifications, reminders), Montreal region — Canada. Resend (United States) remains as a temporary fallback, removal planned by September 30, 2026
• Cloudflare Turnstile — anti-bot protection on the site's public forms (processes the visitor's IP address, no profiling) — United States (global delivery network)
• Anthropic — built-in help assistant (usage questions only, no access to your business data, no training on submitted data) — United States
• GoatCounter — cookie-less audience counter with no identifiers, IP address not retained — European Union

Data remains the exclusive property of your company. Astérion Solutions inc. acts only as the technical guardian of your data.

You have the following rights:

• Access and consultation via the application
• Modification and rectification
• Data export on request
• Data deletion no later than 90 days after the end of the contract (except legal obligations), with written confirmation on request

Three answers we prefer to give before being asked:

• Certifications: Astérion Solutions inc. itself is not SOC 2 or ISO 27001 certified — we inherit the infrastructure controls of Google Cloud (certified SOC 2 and ISO 27001/27017/27018), and our own controls are described in the data processing agreement, available on request
• Administrator access: technically, our staff can access hosted data. This access is only used for customer-requested support or service operation, and every sensitive action is recorded in the hash-chained audit log, where any alteration is detectable
• Continuity: a written plan designates a backup administrator with the access needed to keep the service running should the founder be unavailable for an extended period, and a source-code escrow agreement with a third party can be set up on contractual request