Your data stays in Canada

Hosting planned with Amazon Web Services (AWS), Canada (Central) region, in Montréal. The database, backups, logs and emails stay in Montréal.

We state the limits: Amazon is an American company, and some AWS account management data (billing, alerts) may be processed outside Canada. The expression “data hosted in Canada” refers to the application and your customers' data.

Two ways to sign in

Organizations: people sign in with your organization’s Microsoft Entra ID. Only the groups you designate have access.
Individuals and small teams: an administrator invites each person by email. They sign in with a 6-digit code received by email, valid for 10 minutes. Each invitation takes a licence.
Either way, we store no passwords.
With Entra, when a person leaves the group, their access ends at the next sign-in (after 8 hours at most for a session already open).
Sessions last 8 hours at most and close after 2 hours of inactivity (adjustable).
Status: in pilot. Entra sign-in is tested in a simulator, to be validated with your tenant.

No AI provided by Borealmap

We provide no artificial intelligence, we send your data to no AI provider and we train no model. If you wish, you can connect your own enterprise AI: you decide whether, what and where to. If your AI is an external service, you are responsible for what it receives.

Technical protection (target design)

Encryption of exchanges (TLS) and encryption of data at rest by AWS services.
Database on a private network, secrets in a dedicated vault, minimal rights for each component.
Security logs without personal information, kept for 30 days.
Daily backups kept for 30 days.
Infrastructure changes are made through code, reviewed before each deployment and can be rolled back.

What we do not claim

Borealmap is a young company run by one person. We hold no SOC 2 or ISO 27001 certification to date.
An independent penetration test is planned before welcoming a first paying enterprise customer. It has not been done yet.
The product is developed with the help of AI tools, then reviewed and tested by the founder.
Recovery objectives (targets, not measured, not guaranteed): maximum data loss aimed for 1 hour, recovery aimed for within 8 hours for an ordinary outage.
No formal accessibility audit to date. The target is WCAG 2.1 AA conformance; an audit is planned.
Support in French, business days, by a single person: no 24-hour support.

Sovereignty and foreign law

Microsoft is an American company. Hosting your data in Canada is not the same as removing it from all foreign law: an American authority could in theory require Microsoft to hand over data stored in Canada. We tell you this clearly so that your legal team can assess this risk in its PIA (privacy impact assessment).

Possible measures to study with you: customer-managed encryption keys, approval of Microsoft support access, or another host if your requirement calls for it. What will be offered remains to be confirmed.

Privacy (Quebec Law 25 / Loi 25)

You are the party responsible for the personal information contained in your diagrams; we act as a service provider (processor) (qualification to be validated by a lawyer).
We process data only to provide the service. No advertising, no resale.
We keep a register of confidentiality incidents and notify you without delay (target: 24 hours after confirmation).
End of contract: you export your diagrams for 30 days; we then delete your data, and backup copies expire no later than 60 days after the end of the contract (target).
We provide a PIA (privacy impact assessment) template already filled in for Borealmap.

Subprocessors

Amazon Web Services (AWS): hosting and emails, Canada (Central) region, in Montréal.
Microsoft Entra ID: sign-in through your organization, in your directory, if you use it.
Payment: provider to be confirmed.

Report a security issue

Write to the contact address shown on the Contact page. We acknowledge receipt within one business day (target) and fix vulnerabilities according to their severity.

Documents available on request

Security policy, access control, incident response, backups and continuity, change management, supplier management, retention and deletion, pre-filled security questionnaire, PIA (privacy impact assessment) template. They describe the target design and are neither a certification nor an audit.

Security and compliance, plainly stated.