Where your clients' data lives, and who can touch it.

Canadian data residency#

All data is processed and stored on Amazon Web Services (AWS) servers in Canada. Your client information never leaves Canadian jurisdiction.

• Region: Canada (Montreal) on AWS
• Compliant with Canadian data sovereignty requirements
• PIPEDA-aligned data handling practices

What data we handle#

BrokerPlus works with your mortgage book data (maturity dates, rates, balances, property values, and client contact information) to surface refinance and renewal opportunities. We don't process sensitive financial documents like pay stubs, tax returns, or bank statements.

Encryption#

All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Authentication is handled through secure OAuth 2.0 (we never store your passwords).

Access controls#

Strict role-based access ensures everyone sees only what they should:

• Brokers/agents see only their own clients and deals
• Brokerages see activity across their agents, but never another brokerage's data

This supports both PIPEDA's access limitation requirements and FSRA's expectation that brokerages maintain oversight of their agents.

Audit trail#

Every action is logged - every file access, every outreach sent, every report generated. Timestamped and immutable.

This helps you meet FINTRAC's record-keeping requirements and gives you a clear paper trail if FSRA ever comes asking.

Data retention and deletion#

We maintain a formal data retention policy. You can request deletion of your data at any time, and we'll comply promptly. When you are offboarded, your data is purged (we don't hold onto it).

Breach response#

We maintain a documented incident response plan in line with PIPEDA's mandatory breach notification requirements. If something ever goes wrong, we notify affected parties and the Privacy Commissioner as required by law.

Cyber insurance#

BrokerPlus carries cyber liability insurance to protect both us and our customers.

Compliance summary#