Security and Canadian data residency
Client financial data hosted in Canada, isolated per tenant at the database layer, and reachable only through authenticated, tenant-scoped requests.
Canadian-hosted data with fail-closed per-tenant isolation
Locked-down access
No public data access — every read runs through authenticated, tenant-scoped server actions.
Data residency
Hosted on Postgres in ca-central-1, aligned with PIPEDA and provincial privacy law.
Audited and isolated
Signed tenant sessions, JWT-verified portals, and an append-only audit log.
Accounting firms hold the most sensitive data a business has
Bank details, payroll, tax filings, ownership structures. A breach at a firm is a breach at every client of that firm simultaneously, which is why the security question arrives early in every evaluation.
Canadian firms carry an additional constraint: PIPEDA, provincial privacy law, and in many cases a client expectation that the data does not leave the country.
How the security model works
Authentication issues a signed session; every API request is verified against the identity provider's public keys. The caller's profile pins exactly one tenant, and every query is filtered by that tenant before it reaches the database.
Row-level security policies in Postgres enforce the same boundary independently, so the isolation is fail-closed: an application-layer mistake cannot expose another firm's records. Every mutation writes to an append-only audit log carrying the actor, the action and the affected entity.
- Data hosted on Postgres in ca-central-1
- Asymmetric JWT verification against the identity provider's public keys
- Row-level security enforcing tenant isolation independently of the application
- Append-only audit log of every mutation
What changes for the firm day-to-day
The security section of a client's due-diligence questionnaire has answers the firm can give without calling anyone.
The audit log means "who changed this, and when" is a query rather than an investigation.
What ships in the module
- Canadian data residency on Postgres in ca-central-1.
- Asymmetric JWT verification and signed tenant sessions.
- Fail-closed row-level security enforcing per-tenant isolation.
- An append-only audit log covering every mutation.
Updated July 2026