Responsible AI and Security

An AI Employee works inside your email, files and business systems. This page explains how we keep that work safe: what it can reach, who approves what it sends, and how we protect your data.

1. SOC 2 Type II

We follow the SOC 2 Type II requirements of the AICPA Trust Services Criteria for security, availability and confidentiality. Our SOC 2 Type II report is in progress. We will update this page when it is issued, and we can share our current controls with you under NDA during a sales review.

2. A person stays in charge

• Nothing goes to a client, supplier or the public until a named person at your company has approved it. You choose who that person is.
• The AI Employee drafts, checks and prepares. Your team decides.
• You can pause it or change what it is allowed to do at any time.

3. It only reaches what you give it

• Access is granted per system and per account, and only for the work you asked for.
• Each staff member sees only what their role allows. A site super does not see payroll because the AI Employee can.
• Access can be removed in minutes, and we remove it at the end of an engagement.

4. Your data stays yours

• Your documents, emails and records are used only to do your work. We do not sell them or use them to market to anyone else.
• One client's information is never used in another client's work.
• At the end of an engagement we return or delete your data, as you choose.

5. Every action is on the record

The AI Employee keeps a log of what it did, when, and for whom. You can ask for that record at any time.

6. How we protect it

• Encryption in transit for every connection to your systems.
• Individual accounts with strong authentication for our staff. No shared passwords.
• Credentials for your systems are stored separately from working files and are never written into documents or messages.
• If a security incident affects your information, we tell you promptly, and we notify the Office of the Privacy Commissioner of Canada where PIPEDA requires it.

7. Privacy law

We handle personal information under Canada's PIPEDA and, for Quebec clients, Law 25. Our Privacy Policy covers what this website collects.

8. Questions