Security

1. Guiding principles

Security is built into our products from the design stage ("secure by design"). We apply the principle of least privilege, defence in depth, and a secure development life cycle. We use public frameworks as references, including ISO/IEC 27001, OWASP and the NIST CSF, and we take into account the requirements of PIPEDA and Quebec's Law 25.

SignalOrange does not hold an ISO/IEC 27001 certification or a SOC 2 attestation. The frameworks named above are used only as references.

2. Hosting and jurisdiction

• All production servers are hosted in Canada, mainly in Beauharnois (Quebec) at OVH Canada and on our private infrastructure in Quebec.
• Backups are stored in two separate Canadian regions.
• Some subprocessors (AI providers through Router) may process data outside Canada, with Guard turned on and under zero-retention agreements. See the DPA for the full list.

3. Encryption

3.1 In transit

All communication with our services uses TLS 1.3 with modern cipher suites (ECDHE + AEAD). Certificates are managed through Let's Encrypt with automatic renewal, and HSTS is enabled to force HTTPS.

3.2 At rest

Sensitive data (credentials, secrets, tokens, content encrypted at the application level) is encrypted with AES-256-GCM through the Cloak library. PostgreSQL databases are encrypted at the disk level. Backups are encrypted with separately managed keys.

3.3 Passwords

User passwords are hashed with Argon2id (parameters in line with the OWASP 2025 recommendations). We never have access to your passwords in plain text.

4. Access control

• Multi-tenant architecture with strict isolation by organization_id at the database level.
• Two-factor authentication (2FA) available on every account, mandatory for administrators.
• Granular roles (member, administrator, super-admin) with permissions configurable per organization.
• SignalOrange staff access limited to what is strictly necessary, a complete audit log, mandatory 2FA.
• Sessions expire after 30 days of inactivity (configurable per organization).

5. Secure development

• Mandatory code review before anything is merged to production.
• Automated static analysis (mix sobelow, linting) on every pull request.
• Dependency audits (mix deps.audit, Dependabot), with priority updates for high and critical CVEs.
• Automated tests (unit, integration, end-to-end) with minimum coverage.
• Separate environments for development, staging and production.

6. Monitoring and logging

• 24/7 application monitoring with Prometheus and OpenTelemetry.
• Logs aggregated in a central system hosted in Canada, kept for 90 days.
• Automatic alerts on anomalies (error rate, latency, suspicious authentication attempts).
• Complete logging of administrative access and sensitive actions (audit trail).

7. Backups and continuity

• Automatic daily backups of all production databases.
• Retention: 30 days hot, up to 90 days in cold storage.
• Backups encrypted at rest (AES-256) with keys separate from production.
• Restore tests carried out every quarter.
• Target RPO: 24 hours. Target RTO: 4 hours for critical services.

8. Router Guard: AI anti-exfiltration

Our Router API automatically applies Guard — a filter that removes personally identifiable information (PII), secrets, API keys, .env variables and authentication tokens before anything is sent to third-party AI models.

We have negotiated zero-retention agreements with Anthropic and OpenAI: the data sent is neither kept nor used to train their models. Router usage logs stay hosted in Montreal.

9. Incident response

We have a documented incident response plan, with defined roles and an incident register. If a confidentiality incident presents a risk of serious injury, we will notify the people concerned without delay and notify the Commission d'accès à l'information du Québec, as required by Law 25 and PIPEDA.

• Detection and confirmation of the incident.
• Containment (isolating the affected system, revoking credentials).
• Eradication and recovery (from clean backups if needed).
• Notification of the authorities and the people concerned when required.
• Post-mortem and implementation of fixes.

10. Responsible disclosure (bug bounty)

If you find a vulnerability, thank you for reporting it responsibly to securite@signalorange.ca. We commit to:

• Acknowledge receipt within 48 hours.
• Provide an initial assessment within 7 days.
• Not take legal action against security researchers acting in good faith.
• Publicly credit the authors of valid reports (with their consent).

Please do not exploit the vulnerability beyond what is needed to demonstrate it, and do not disclose it publicly before we have fixed it.

11. Applicable laws and certifications

• PIPEDA — Canada's federal personal information protection law.
• Law 25 — Quebec's modernized personal information protection law (in force since 2023-2024).
• Law 14 (formerly 101) — Compliance with the Charter of the French Language.
• PCI DSS — Payments are processed by Stripe, a Level 1 certified provider. SignalOrange never stores card data.
• Certifications — SignalOrange does not hold an ISO/IEC 27001 certification or a SOC 2 attestation.

12. Subprocessors and supply chain

We carry out due diligence before bringing on a new subprocessor: certifications, security policies, processing jurisdiction, contractual agreements. The full list of our subprocessors and their jurisdictions is in our Data processing agreement (DPA).

13. Contact us

For any security incident, vulnerability or question about our practices: securite@signalorange.ca.