Data & Security Policy

1. Purpose and scope

This policy sets out how Ablaze.Digital Inc. manages data to ensure legal compliance, quality, security and usefulness. It applies to all employees, contractors, vendors and systems that handle Ablaze.Digital data or client data, including our website, our client portal and our internal business-management platform. It complements our Privacy Policy, which explains how we handle personal information and your rights.

2. Governance principles

• Data is an asset and a responsibility: decisions weigh legal, operational and ethical obligations.
• Accountability: every data domain has a designated owner and steward.
• Privacy by design and by default: systems minimize the personal information collected and exposed; the most privacy-protective settings are the default.
• Security and resilience: we protect confidentiality, integrity and availability.
• Auditability and transparency: we keep records that allow audits and demonstrate compliance with PIPEDA, Alberta’s PIPA, Québec’s Law 25, CASL, the GDPR and UK GDPR, U.S. state privacy laws, IFRS record-keeping and, where a client contract requires it, HIPAA.

3. Roles and responsi­bilities

• Leadership: oversight and resourcing of data protection and security.
• Privacy Officer: the person in charge of the protection of personal information; approves privacy impact assessments, coordinates individual rights requests and breach response. Contact: [email protected].
• Data owners and stewards: classify data, approve access and maintain quality and lineage.
• Technology and security: implement controls, monitoring, backups and incident response.
• Legal and compliance: interpret legal obligations, review contracts and liaise with auditors and regulators.

4. Data classification

5. Data lifecycle

• Collection: collect only what a documented purpose requires.
• Storage: keep data in approved systems — principally our internal business platform — never in personal accounts or unapproved tools.
• Use: role-based access, logging and periodic access reviews.
• Sharing: only under data-sharing agreements or Data Processing Addenda.
• Retention and deletion: follow the retention periods in our Privacy Policy and client agreements, then delete or anonymize securely.

6. How our website and client portal are secured

• Encryption in transit: every page and API call uses HTTPS with HTTP Strict Transport Security.
• Hardened pages: a strict Content Security Policy, anti-framing and other security headers on every page.
• No card data: payments are handled entirely by Stripe’s PCI DSS–certified hosted checkout.
• Portal sessions: sign-in creates an HttpOnly, Secure session cookie that scripts cannot read, expires after 12 hours and is revoked on sign-out. Each client sees only their own organization’s data, enforced on the server.
• Forms: submitted server-side over a private connection to our internal platform; protected by bot filtering and rate limiting.
• Staff access: internal systems sit behind zero-trust access controls with multi-factor authentication; there is no public administrative interface.
• Tracking: no analytics or marketing scripts load until a visitor consents.

7. Security controls

Least-privilege, role-based access; multi-factor authentication for privileged accounts; encryption in transit and at rest; secure key and secret management; centralized logging and anomaly monitoring; vulnerability scanning and regular patching; a secure development lifecycle with code review and automated checks; and periodic security testing.

8. Vendors and subprocessors

We perform due diligence on vendors that handle data, use contractual data-protection terms, and review them periodically, with stricter controls for vendors handling Restricted data. Our principal infrastructure providers include Cloudflare (hosting, network security, storage and our internal platform) and Stripe (payments). Clients can request our current subprocessor list, and we notify clients of material changes as set out in their Data Processing Addendum.

9. Client data and AI projects

When we process personal information for a client we act as a processor or service provider: we follow the client’s documented instructions, apply the safeguards in our Data Processing Addendum, assist with individual rights requests, and return or delete data at the end of the engagement. For AI projects we use only the data a use case needs, document data flows, choose AI providers and settings that do not use client data to train their models where available, and do not place Restricted data in AI tools without the client’s written authorization.

10. Privacy and risk assessments

Privacy impact assessments are completed before new high-risk processing — including sensitive data, large-scale profiling, new AI systems, new third-party platforms and transfers of personal information outside Québec — and the Privacy Officer approves mitigations before launch.

11. Backup and continuity

Critical systems are backed up and restores are tested. Recovery objectives are defined for critical services and reviewed at least annually as part of business-continuity planning.

12. Incident response and breach notification

We follow a documented incident-response plan: contain, assess, notify, remediate and learn. Every privacy incident is recorded in our breach register. Where the law requires, we notify:

• the Office of the Privacy Commissioner of Canada and affected individuals of a breach of security safeguards that creates a real risk of significant harm, as soon as feasible;
• Alberta’s Information and Privacy Commissioner, without unreasonable delay, where there is a real risk of significant harm;
• Québec’s Commission d’accès à l’information and affected persons promptly where a confidentiality incident presents a risk of serious injury;
• the competent EU/UK supervisory authority within 72 hours where required by the GDPR, and affected individuals where the risk is high; and
• affected clients without undue delay, as set out in their Data Processing Addendum, so they can meet their own obligations.

13. Reporting a vulnerability

If you believe you have found a security vulnerability in our website, portal or systems, please email [email protected] with the subject “Security” and enough detail for us to reproduce it. Please give us reasonable time to fix it before disclosing it publicly, do not access or change data that is not yours, and do not disrupt our services. We will acknowledge your report and keep you informed. Our security.txt file has the same details.

14. Training, audit and review

All staff and contractors complete privacy, security, anti-spam (CASL) and data-governance training at onboarding and annually. We monitor compliance, report on governance quarterly to leadership, and review this policy at least annually and whenever the law or our services change materially. Exceptions require written approval from the Privacy Officer and leadership.

Version 2.0 replaces the Corporate Data Governance Policy previously published on this page.

This document is published in English and French; both versions have equal standing.