Security and data

Data residency

The database and the document vault are both in the Canada (Central) region, near Montreal — and so is the application that serves them. That was a deciding factor: the first database provider considered was dropped because it had no Canadian region at all. Email is the exception, and it is named below rather than glossed over.

What leaves Canada

Being straight about this is more useful than a badge. Five things involve a company outside the country, each for a different reason. The application's own processing is not one of them: it was moved to Montreal on 4 September 2026, into the same region as the database.

• Email delivery

  Reminder, sign-in, password-reset and security-notice emails are sent through a transactional provider whose infrastructure is in the United States and which offers no Canadian region. That means an email address and the contents of a reminder cross the border. A reminder carries a deadline and a link back here, never a document; link tracking is switched off, so the link is the plain address of this site. A security notice says only that your vault PIN was set, replaced or removed, and when; it never carries the PIN, a document or where the change was made. The one attachment Standkeep ever sends is a quote, invoice, credit note, receipt or statement of account you choose to email to your client from its own page, or that Standkeep sends on the schedule of a recurring invoice you set to send, or resends as an overdue reminder if you have turned reminders on (since 14 and 15 September 2026): that PDF, the client's address and your covering note go through the same provider, and nothing from the vault ever does.

• Payments

  Card details go from your browser to the payment provider and never touch Standkeep's servers or database — all Standkeep keeps is an opaque customer id. What that provider does hold, in the United States, is your email address and the billing name and address it collects at checkout. Standkeep itself never asks you for an address.

• Hosting

  The application runs on a global hosting platform, and its functions are pinned to that platform's Montreal region. What stays outside the country is the platform's own operation: build and runtime logs are handled by a US company, and the small piece of routing that picks your language runs at the network edge, everywhere.

• Push notifications

  If you turn on notifications in the mobile app, the notice travels through a push relay and then through Apple or Google to reach your phone. It carries your corporation's name, the obligation and the date — deliberately nothing else, because a lock screen is visible to whoever is holding the phone. It is off until you switch it on, it stops when you sign out, and it never replaces the email: the email is the reminder and is sent whether or not a notification gets through.

• Reading a document for you

  If you ask Standkeep to read a document for you — a certificate of incorporation, articles or a registry profile into the corporation form, or a file you are about to store in the vault, to suggest its kind and title — the text of that PDF is sent to an AI provider in the United States, which returns what it read. Before it is sent, the text is read on Standkeep's own server and addresses, dates of birth and contact details are stripped; for a vault document only the opening page or so is sent; the file itself never leaves. Every such call is logged with the text sent and the answer returned, is counted against a monthly limit for your organisation, and fills in nothing until you accept each value. You can always type the details instead. The “other matters” of an annual resolution are matched the same way to Standkeep’s six fixed clauses — the AI picks a clause and the names in it from your words, never writes a sentence. A question you ask on the “Ask about a rule” page goes the same way, with the rule passages it is about; a question that matches no rule is not sent at all. The free filing check’s optional plain-language summary is written the same way, from the corporation’s public record and the date alone — nothing about you is in it. What is outstanding across all your corporations over the coming month, and the draft notice for each one, are written the same way, from the dates the engine computed and nothing else — no note, no document, no person — and nothing is sent to anyone from that page.

All five are assessed in Standkeep's privacy impact assessment, adopted September 15, 2026. Quebec residents are in scope, so Law 25 applies alongside PIPEDA, including its rules on transferring personal information outside the province. The assessment is redone before any new transfer, and reviewed every year.

Credentials we do not have

Standkeep never stores a corporation key, a CRA sign-in or a registry password, because it never files anything for you and therefore never needs one. This is enforced in the schema, not by policy: an automated test scans every column in the database for anything that could hold a credential and fails the build if it finds one. The few application-issued secrets that do exist — a calendar feed token, for instance — are listed explicitly with the reason each is tolerated.

Sign-in

Signing in takes your email address, a password, and a six-digit code from an authenticator app if you have set one up. The password is stored only as a salted scrypt hash at the parameters OWASP recommends, so a copy of the database does not give anyone your password; the second-factor secret is encrypted with a key that is not in the database. Recovery codes are hashed too, and shown to you exactly once. Session cookies are scoped to this host only and are never set on a parent domain, so this product and its parent cannot compromise each other. When you choose a password, Standkeep checks it against a public breach corpus and refuses one that already appears there. That check sends five characters of a hash and nothing else — not the password, not your address, not an account id — and if the service is unreachable your password is simply accepted, because a third party must never be able to stop you setting one.

Documents

The vault is a private bucket, encrypted at rest, with a size cap and a fixed list of accepted file types. Nothing in it is publicly reachable. A document you open in the app is read through a signed link that expires in sixty seconds; the links bundled into an export last ten minutes, which is as long as they need to survive for you to download them. Object keys are opaque identifiers, so no file name or path reveals anything about the corporation it belongs to. You can also put a four-digit PIN in front of reading a document: it is asked for in the browser, five wrong tries close the vault for fifteen minutes and each further five for twice as long, an unlock lasts fifteen minutes, and while it is on an export carries your records without links to the files. It is stored the way a password is — salted and hashed, never readable back — and it is a lock on a borrowed screen, not a second password: it never guards signing in, and it never delays a reminder.

What is not collected

Only what a rule needs. No social insurance numbers, no bank details, no residential addresses and no dates of birth — there is no field for either anywhere, which is why your register of individuals with significant control stays a document you upload rather than data held here. Payment instructions you print on your invoices are free text, stored as you write them — an e-Transfer address belongs there, not an account number — and a client billed as a person has no address field. The free public filing check records a lookup's corporation number, language and outcome so the funnel can be measured — no IP address and no session identifier is written down. Your IP address is read to rate-limit that form, held in memory for the length of the window and never stored; that is its only use.

Payments

Card details go to Stripe and never touch Standkeep. The application stores a customer reference and a subscription state, not a card number.

Your control

Export everything at any time, including the support threads and suggestions you wrote yourself. Delete the account from inside the product; the deletion cancels the subscription first and stops if the payment provider refuses, so an account is never half-deleted with a live subscription behind it.

Reporting a problem

If you believe you have found a security problem, open a support ticket describing it and we will come back to you. Please do not post details publicly before we have had a chance to fix it.

SupportPrivacy