Skip to content
FortaRisks
Free report

Privacy Policy

Last updated: October 5, 2026

This Privacy Policy explains how FortaRisks CyberSecurity Inc. ("FortaRisks", "we", "us") collects, uses, discloses and protects personal information in connection with the FortaRisks platform (the "Platform"), this website and related services (the "Services").

1. What we do

FortaRisks is a B2B SaaS cybersecurity risk management platform. We process professional and account-related information to create and manage accounts, secure access, deliver the Services, bill customers, provide support and improve our products.

2. Information we collect

  • Business identity and contact: name, job title, business email, business phone, organization.
  • Account and access: SSO and MFA usage, roles and permissions, access logs and audit trails.
  • Usage and technical: actions performed, device and browser metadata, IP address, time zone and other technical identifiers.
  • Forms on this site: email and, depending on the form, name, organization, job title, company size, domain name and message; the language, the country and where the visit came from (campaign, referring site, landing page).
  • Customer-provided content: content you upload, enter or generate through the Services, including items relating to risk and compliance.

3. This site: requests, register and newsletter

Every request sent through a form on this site (contact, demo, exposure report, assessment, quarterly report, kit, newsletter) is written to a register kept on our server, in Canada, then passed on to our team by email. A copy may also reach the team through an internal alert messaging service. This register holds neither your IP address nor your browser's characteristics.

A subscription to the Friday recap only takes effect once confirmed through the link we send you. Every send carries an unsubscribe link. We keep the date of the request, of the confirmation and of the unsubscription.

On the Demo page, the booking calendar is provided by Google Calendar. It only loads once you send your demo request; your booking is then processed by Google.

4. Why we collect it

To provide and operate the Services, secure the Services, manage billing and customer relationships, measure and improve the product, and communicate with users.

5. Legal bases and consent

We rely on performance of a contract, legitimate interests where permitted (for example security and fraud prevention), and consent when required. B2B marketing only happens with opt-in.

6. Hosting and data residency

By default, customer data is hosted in Canada. At onboarding, you may choose hosting in the United States or the European Union, where available. Transfers outside Québec or Canada, where necessary (for example support), are covered by contractual safeguards.

7. Sharing with service providers

We use vendors to help us operate the Services, such as cloud hosting, email delivery, monitoring and support. We do not sell personal information.

For this site, they are:

  • Cloudflare: relay and protection of traffic, anti-bot check on forms and cookieless audience measurement.
  • Google: the company's email, through which your requests travel; the booking calendar, if you open it; audience measurement, with your consent.
  • LinkedIn: advertising tag, with your consent.
  • Telegram: internal alert messaging, when that alert is active.

Some of these vendors process information outside Canada. The data you entrust to the Platform is not sent to them.

8. Cookies and similar technologies

We use strictly necessary cookies, analytics with consent, and B2B marketing cookies only with opt-in consent. See our Cookie Policy.

9. AI features and automated decision-making

Actions with meaningful impact require human review, and relevant activity is logged. We do not use AI for marketing profiling without consent.

10. Security

Encryption in transit and at rest, SSO and MFA support, granular role-based access control, audit logging and monitoring, encrypted backups, vulnerability management and an incident response process.

11. Retention

We retain personal information only for as long as necessary to fulfill the purposes described above, after which we securely delete or de-identify it.

12. Your rights (Canada / Québec)

You may request access to or a copy of your personal information, ask us to correct it, withdraw consent for non-essential processing, and request deletion where legally permitted. You may also ask that it be communicated to you in a structured, commonly used technological format.

To exercise these rights, write to our privacy officer (see the Contact section). If our answer does not satisfy you, you may contact the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca).

13. Updates to this policy

The "Last updated" date above indicates when the latest version took effect.

14. Contact

Our privacy officer, FortaRisks' CEO & Founder, answers any privacy question and any request for access, correction or deletion: privacy@fortarisks.com. FortaRisks CyberSecurity Inc., 108 Rue Alfred Desrochers, Saint-Augustin-de-Desmaures (QC) G3A 2T1, Canada.