Security and sovereignty by design
We sell to security teams, so we hold ourselves to their standards. Here is how we protect your data, and which law can reach it.
How we protect your data
Platform data hosted in Canada
The data you entrust to the platform is hosted in Canada by default, by a Canadian company. That is what matters against US vendors: the CLOUD Act lets authorities compel a vendor subject to US law to hand over data it holds, including data hosted abroad.
Encryption and access control
Encryption in transit and at rest, single sign-on, multi-factor authentication and role-based access. Managed-service tenants are isolated at the database level.
Monitoring and response
Audit logging, continuous monitoring, encrypted backups, vulnerability management and a documented incident response process.
Privacy and consent
No browser fingerprinting and no advertising tracking without your agreement. Analytics and the advertising tag load only with your consent. We never sell personal information.
Transparent and explainable
Our risk scoring is decomposable and traceable. Recommendations are explainable, and your content is never used to train models served to other customers.
We meet the frameworks we help you meet
FortaRisks is operated to the standards we measure for you, including SOC 2 and ISO 27001 practices, with audit-ready evidence.
Security controls
- Encryption in transit and at rest
- Single sign-on (SSO) and multi-factor authentication
- Role-based access control
- Audit logging and monitoring
- Encrypted backups
- Vulnerability management
- Documented incident response
- Database-level tenant isolation
The CLOUD Act follows the provider, not the server.
This is the point most procurement questionnaires miss. The US CLOUD Act allows a provider subject to United States law to be compelled to produce data it holds or controls, wherever that data is hosted. A data centre in Frankfurt or Montreal changes nothing if the company, its parent or its subsidiary falls under that jurisdiction. Server location answers the wrong question; the right one is about the provider's nationality.
What stays in Canada
The data you entrust to the platform: assessments, risk register, evidence, scan results, supplier files. FortaRisks is a Canadian company and this data is hosted in Canada by default.
What goes through a third party
Like most websites, this one relies on a few external services: a relay that routes and protects traffic, an email service to answer you and, if you consent, audience measurement. Our privacy policy describes them.
Another hosting location if you require it
Canada is the default, not a constraint. Hosting in the European Union or the United States is possible from onboarding, when your organization, your regulator or your customer requires it.
What it changes, depending on your situation
Canadian organization
The data you entrust to the platform stays in Canada. That simplifies what Law 25 and PIPEDA ask you to document.
Defence supplier
The Canadian Program for Cyber Security Certification gates access to contracts. We prepare the attestation, including the 13 ITSP.10.171 requirements at Level 1.
European organization
Canada benefits from a European Commission adequacy decision covering private organizations subject to PIPEDA. A transfer of personal data from the EU rests on that basis rather than on a contractual construct.
What we never do
- Sell or rent your personal information
- Train models served to other customers on your content
- Store platform data outside Canada without your agreement
- Set a non-essential third-party cookie before your consent
- Fingerprint your browser
- Send you an automated reply instead of a real person
Questions from your security team and your lawyers
Who has access to my data on your side?
Access is role-based and limited to the people who need it to operate the service, with multi-factor authentication and logging. Managed-service tenants are isolated at the database level.
How do I get your security package?
On request and under NDA: security package, sub-processor list and framework mapping. Write to us and a person answers.
Are you SOC 2 or ISO 27001 certified?
We operate to those practices and measure ourselves against the same frameworks as our customers, with audit-ready evidence. Our security dossier states exactly where we stand, rather than a logo on a page.
Is your scoring a black box?
No. Every score breaks down to its inputs and its exact calculation, and stays exportable with that breakdown. A grade you cannot defend is of no use to you.
Where is my data by default?
The data you entrust to the platform is hosted in Canada. The public website goes through a relay that routes and protects traffic, and uses audience measurement only with your consent.
Can the CLOUD Act reach you?
It applies to providers subject to United States law. FortaRisks is a Canadian company and hosts platform data in Canada. The external services used by the public website are described in our privacy policy.
What exactly does European adequacy cover?
The European Commission decision covers Canadian private organizations subject to PIPEDA, for personal data received from the Union in a commercial context. We make the detail of our scope available to your legal team.
Can I require hosting in the European Union?
Yes, from onboarding. Tell us which constraint you have to satisfy, regulatory or contractual, and we choose the hosting region accordingly.
Do you use my content to train models?
Never for models served to other customers.
Need our security documentation?
Request our security package, sub-processor list and framework mapping, under NDA.
Request the security documentation