What we do
- Canadian data centre. Records and uploaded files are stored in Montréal, and our application servers run there too. Pages are delivered through a global network, so requests can pass through it in transit. The Sub-processors page lists every service provider.
- Organization isolation. Every table that holds customer data uses database row-level security, so each organization's users see and change only their own organization's data. A two-organization test suite checks this on every change.
- Locked engagement records. Once an engagement record is submitted, it is locked. A correction is saved as a separate, time-stamped record that points at the original.
- Audit trail. Changes to profiles and engagement records are recorded in an append-only audit log, with the team member who made each change.
- Export ledger and checksums. Each export is logged in an append-only ledger with a hash chain. Export bundles include a manifest and SHA-256 checksums, so a recipient can confirm each file is unchanged since export.
- Encryption. Data is encrypted in transit and at rest by our hosting providers.
- Two-factor sign-in on every account. Every member sets up an authenticator app the first time they sign in, and every sign-in after that asks for a 6-digit code. Once an account is set up, the database serves that account's data only to a session that has passed the code. If a member loses their phone, an administrator in your organization resets them: the reset signs them out on every device, and they set up a new authenticator at their next sign-in.
- Access control. Roles separate administrators, managers and viewers, with a session timeout after 30 minutes idle, rate limiting on sign-in and exports, and security headers on every response.
- Automated security monitoring. Every 10 minutes an automated check reviews sign-in, access, export and deletion activity against a set of rules, and emails our team about anything unusual so a person can look at it.
- Optional AI. AI starts switched off for new organizations, and an administrator chooses whether to turn on natural-language reporting and email-draft suggestions. Your data is used only to provide StakeholderHub to your organization.
- Incident notice. If a security incident affects your data, we tell your administrators without undue delay.
- Your evidence, your decisions. StakeholderHub organizes and exports your engagement evidence. You and your counsel decide how it meets a duty, a regulator's requirement or a court's standard.
Questions and security reports
Vulnerability reports and security questionnaires go to security@stakeholderhub.ca. We also publish a standard security.txt.