How we protect your clients’ files

What is in place

• Primary data in Canada

  Your database, sign-ins, uploaded files, and backups are hosted on Supabase in AWS Canada Central (Montréal). The server code that reads and writes your data runs in Vercel’s Montréal region.

• Encryption with a key per firm

  Data travels over TLS and is encrypted at rest by the infrastructure. On top of that, each firm has its own AES-256-GCM key. We use it to encrypt uploaded documents before they are stored, and sensitive fields such as client names, emails, phone numbers, SIN and passport numbers, notes, questionnaire answers, messages, and signatures. Some operational fields, such as appointment times and status labels, are not encrypted at the application level. Yuzu staff who hold the platform key can technically decrypt firm keys to run, restore, or secure the service, and we limit that access.

• Each firm sees only its own data

  Row-level security in the database scopes every record to its firm. Roles then decide what each person can do: owners and admins manage settings, invitations, and the audit log, and can destroy files once their retention period ends; members work client files; accounting users see finance but not immigration files. Automated tests check these rules against a copy of the production database policies.

• Private file storage

  Every storage bucket is private, so there are no public links to stored files. Files are reached only after an access check, and client documents are stored encrypted with the firm’s key.

• Sign-in protection

  Staff can turn on two-factor sign-in with an authenticator app, and firm admins can require it for all staff in Settings → Compliance. Passwords must be 8 to 128 characters with an uppercase letter, a lowercase letter, a number, and a symbol, for staff and the client portal alike. Failed staff sign-ins are limited to 5 per email and 30 per IP address every 15 minutes, and password-reset requests are capped per day. The client portal and public booking pages have their own attempt limits.

• Append-only audit log

  Sensitive actions, such as client and file exports, deletions, and message redactions, are written to a security audit log. The database refuses any change to, or deletion of, those entries. Firm admins can review the log in Settings.

• CICC six-year retention

  A file closes when staff close it or when it reaches a final decision (granted, refused, or completed). Dossierly then keeps it for six years, matching the CICC Client File Management Regulation, and will not destroy it before then. After that, an admin can destroy it, and an encrypted entry in the destruction register records that it happened.

• IRCC portal extension (in development)

  Dossierly for IRCC never submits anything on your behalf: you preview and apply each page, and it won’t click submit, sign, pay, or consent buttons. Its audit trail records which fields were filled (field keys only, never the values), and firm admins can turn it off for the whole workspace, which cuts off connected extensions right away.

• PIPEDA and Québec Law 25

  The product helps you meet your obligations under PIPEDA and Québec’s Law 25: a data processing addendum, a JSON export of a client’s personal information for access requests, deletion requests from the client portal, and Law 25 and PIPEDA templates for your practice. We keep a register of confidentiality incidents and notify as the law requires, as our privacy policy describes.

• No AI on client files

  Questionnaires, PDF filling, booking, and document review run on software logic. We do not send client files to generative AI providers.