Where your clients' data lives, and who can touch it.

Canadian data residency#

All data is processed and stored on Amazon Web Services (AWS) servers in Canada. Your client information never leaves Canadian jurisdiction.

• Region: Canada (Montreal) on AWS
• Compliant with Canadian data sovereignty requirements
• PIPEDA-aligned data handling practices

What data we handle#

BrokerPlus is a full mortgage workflow platform, so it handles the whole file. That includes your clients' identity and contact details, employment and income, assets and liabilities, property information, and the supporting documents behind them: pay stubs, T4s, notices of assessment, bank statements, and letters of employment.

Where you use those features, it also handles credit reports pulled on your instruction, images of government-issued ID and the live photograph captured during identity verification, sanctions and politically exposed person screening results, and recordings and transcripts of calls, text messages, and meetings run through the platform.

Social Insurance Numbers are collected only where a credit pull or a lender submission requires one. They are encrypted at the field level on top of disk encryption, and they are never included in the public API.

Encryption#

All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Sensitive personal fields, including names, email addresses, phone numbers, Social Insurance Numbers, and financial details, are additionally encrypted inside the database with AES-256-GCM, with a separate keyed index so they stay searchable without being stored in the clear.

Files in storage are versioned and replicated across availability zones within the Canadian region.

Authentication#

Sign-in supports passwords, magic links, and passkeys. Two-factor authentication with an authenticator app is available on every account. Passwords are stored hashed, never in a recoverable form.

Sessions are held server-side. Which brokerage a request belongs to is determined from the trusted session, never from anything the browser or an API caller can supply.

Access controls#

Everyone sees only what they should:

• Every database read and write is scoped to one brokerage. A request for another brokerage's record returns "not found", never the record
• Within a brokerage, roles and teams control who can see which deals, contacts, commissions, and reports
• A second, automatic safeguard catches any internal query that is missing its tenant filter, so a developer mistake cannot quietly expose another brokerage's data
• A small number of BrokerPlus staff can access accounts through internal tools, only to support and operate the platform. Every administrative action is written to the audit log

This supports both PIPEDA's access limitation requirements and FSRA's expectation that brokerages maintain oversight of their agents.

How we use AI providers#

Document extraction, transcription, summarization, drafting, and the in-platform assistant run on third-party model providers. What we send them is limited to what the feature needs, and our agreements with them prohibit using your data or your clients' data to train their models.

No AI feature decides whether someone qualifies, approves or declines an application, or prices a deal. Actions that matter, such as pulling credit or submitting to a lender, always require a person to confirm. Everything else is a draft for your review unless you choose to let it run automatically.

Audit trail#

Significant actions are logged: file access, document changes, credit pulls and the consent behind them, screenings, outreach sent, reports generated, and administrative changes. The log is append-only and timestamped, and it is removed only when a brokerage is deleted in full.

This helps you meet FINTRAC's record-keeping requirements and gives you a clear paper trail if your regulator ever comes asking.

Availability and backups#

• Customer-facing services run as multiple replicas behind a load balancer, with health-gated, zero-downtime deploys
• The database is a managed instance with automated daily snapshots. Our recovery targets are under four hours to restore and under 24 hours of data
• File storage keeps prior versions of every object for 30 days
• Live service status is published at status.getbrokerplus.ca

API and integrations#

The public API is small and deliberate. An API key acts as the broker who created it and can never see more than they can. Keys are shown once and stored hashed. Webhooks carry record IDs rather than record contents and are signed with an HMAC so you can verify they came from us.

Integrations with lender networks, credit bureaus, identity verification, telephony, email and calendar accounts are connected by you, per account, and can be disconnected at any time.

Data retention and deletion#

You can delete individual documents, contacts, notes, screenings, and conversations directly in the app, and any user can delete their own account from settings. When a brokerage leaves, you have 30 days to export, after which we permanently delete every file and record belonging to the brokerage. That deletion can only be run by an administrator authenticated with a passkey, requires typing the brokerage name back to confirm, and is itself recorded.

The one exception is records Canadian law requires you to keep. Anti-money laundering records are retained for at least five years under FINTRAC rules and are archived rather than deleted.

Incident and breach response#

We maintain a documented incident response plan with a named incident commander and deputy who receive automated alerts in real time. Errors, health checks, and infrastructure events are monitored continuously, with personal information scrubbed before any error report leaves the process.

If something ever goes wrong, we contain it, fix it, and notify affected brokerages and the Privacy Commissioner as required by PIPEDA's mandatory breach notification rules.

How we build#

• Every change is reviewed by someone other than its author before it ships, and passes automated tests, type checks, and tenant isolation checks first
• Company devices run endpoint detection and response and device management, and staff accounts require multi-factor authentication
• Staff who leave have their accounts and tool access removed as part of a documented offboarding procedure
• Infrastructure and application code are version-controlled and reproducible from source

Compliance summary#

A current list of the sub-processors we engage, with the country each one processes data in, is available on request.