Canadian by default. Every exception named.
Residential-care records are some of the most sensitive information a Canadian family will ever share. Our security posture is the product, not a page — every default conservative, every exception documented.
Canadian residency is the default — and every exception is named.
All server-side processing runs in the Canadian region (Vercel yul1, Montreal).
Database, backups, resident documents, and messages in-region (Montreal), encrypted with per-tenant keys.
A subset of operational records is on US storage (Vercel Blob, iad1), being migrated to Canada; anonymized AI-assist calls run on Anthropic (US). No raw PII crosses the border.
Zero data retention on every model call. Anonymization layer mandatory.
Six layers, no weak one.
TLS 1.3, HSTS, and certificate pinning.
Every request is encrypted end-to-end with modern transport standards. HSTS with preload across every surface. Certificate pinning for the native shell.
AES-256 at rest, per-tenant KMS.
Object storage, database disks, and backups are encrypted with per-tenant keys. Column-level encryption for financial and identity fields.
Row-level security, not wishful thinking.
Row-level security on every table — enforced at the database, not the app. No privileged keys in the browser. TOTP MFA for staff + directors. Device attestation on managed tablets.
Append-only. Signature-chained. Forever.
Database-level triggers capture every mutation. Entries are cryptographically chained — tamper-evident by construction. Retention follows the longest applicable provincial statute.
Anonymization before inference. ZDR on.
Every model call passes through a redaction layer — names, addresses, identifiers are stripped before inference. Inference runs on Anthropic Claude under Zero Data Retention terms (US-hosted). Only anonymized payloads cross the boundary; responses are re-associated inside Caremynd.
A runbook, not an aspiration.
Incident response drill every 90 days. 24-hour client notification SLA. Forensic preservation and counsel contact pre-arranged.
Per province. Not per-promise.
Every Canadian jurisdiction has its own privacy act and its own child & family services framework. Here's what Caremynd honours today, and what's on the roadmap.
Residency reflects primary records, resident documents, and backups, which are hosted in Canada (Supabase ca-central-1, Montreal). A subset of operational records is currently on US object storage (Vercel Blob, iad1) and is being migrated to Canada. See the Privacy Policy § 9.
Indigenous data stays Indigenous.
We follow the First Nations principles of ownership, control, access, and possession (OCAP®). Nation-specific data is tagged at the record level. Anonymized datasets cannot be derived from Indigenous-identified records without nation consent, and we don't sell data — ever.
Bring the hardest question.
We'll walk your privacy officer through the whole stack — edge, functions, database, backup, AI boundary — with log samples from a live tenant.