Supplier file

Security, privacy and data handling.

This page is deliberately plain. It says what we commit to in every contract, what we hold, and what we do not hold. If a solicitation requires something not listed here, we will tell you in the first reply rather than the last.

Written into every engagement.

Your accounts, your access controls

Every system we build is deployed into cloud accounts you own, under your identity and access management. We hold access only for the duration of the work, through named accounts, and it is revoked at handover. Nothing we build depends on a Bluestone-controlled service to keep running.

Canadian data residency by default for public bodies

For public-sector work we deploy in Canadian regions unless you instruct otherwise, and we confirm the hosting region and provider in writing per engagement. Private businesses choose their region; we recommend Canada.

FOIPPA and your privacy schedule

Work for a BC public body is subject to the Freedom of Information and Protection of Privacy Act. We sign your privacy protection schedule and your security schedule as issued, and we will complete a privacy impact assessment questionnaire with you before any personal information is in scope.

PIPA for private businesses

For private businesses, BC's Personal Information Protection Act applies. We sign a mutual NDA before any teardown or scoping, treat everything you show us as confidential by default, and return or destroy it at the end of the engagement without being asked.

Read-only means read-only

During a condition assessment we take read access, or a copy of the system in an environment you control, and we change nothing. Who on our side can see it is named to you in advance. Copies are deleted at the end of the assessment and we confirm the deletion in writing.

Named people, approved by you

Anyone added to a build is named to you and approved by you before they touch your system. For public-body work we will provide criminal record checks on request and will not subcontract to anyone you have not approved.

Access, backups and incidents

Multi-factor authentication on every account we hold for your work. Backups configured in your accounts, with the restore procedure documented and tested before handover. If we become aware of a security incident affecting your data we notify you in writing within one business day, and sooner where your schedule requires it.

Built to be taken over

WCAG 2.1 AA is the standard we build to. Documentation is written so an engineer who has never spoken to us can run, back up, and extend the system. You can take the codebase to a different developer at any time, and you do not need to tell us first.