Sovereignty is not a sales pitch, it is our architecture

• Deployment preferably on the client’s own infrastructure, on site or in a Canadian data centre they control.
• No mandatory dependency on a cloud provider subject to the US CLOUD Act for sensitive data.
• Open AI models running locally: queries never leave the client’s environment.
• Transfers outside Quebec, when they are unavoidable, are preceded by a privacy impact assessment under section 17 of Law 25.

• Access granted on the principle of least privilege, by role.
• Multi-factor authentication required on our internal systems.
• Access to client environments is named, logged and revoked as soon as the engagement ends.
• Periodic review of access rights and permissions.

• Encryption of communications (TLS 1.2 and above) and of data at rest.
• Strict partitioning between each client’s environments.
• No copy of client data kept beyond what the services agreement provides for.
• Secure destruction or return of data at the end of the engagement, with an attestation on request.

• Code review before anything goes into production at a client site.
• Test environments fed with anonymized or synthetic data wherever possible.
• A change log kept for every deployment.
• Security updates applied promptly to the components we manage.

• Subcontractors bound by confidentiality and personal information protection undertakings.
• A standing preference for Canadian suppliers, or suppliers that host in Canada.
• A list of subcontractors available on request.
• Suppliers reassessed whenever their practices change significantly.

• Encrypted, verified backups of our internal systems.
• A documented incident response procedure: contain, assess, notify, correct, record.
• Prompt notification of the Commission d’accès à l’information and of the people concerned in the event of an incident presenting a risk of serious injury, as Law 25 requires.
• A register of confidentiality incidents kept up to date.

On your own infrastructure, or on Canadian servers you control, depending on the architecture we settle on together during scoping. Our starting principle: your documents do not leave your environment. When a component has to be hosted elsewhere, it is spelled out in black and white in the agreement and preceded by a privacy impact assessment.

No, never. The agents we deploy read your documents in order to answer, an approach known as RAG, without retraining any model. No client data is ever used to improve a model, ours or a supplier’s.

A privacy officer is appointed, every engagement touching personal information goes through a privacy impact assessment, incidents are entered in a register and reported to the Commission d’accès à l’information when required, and our agreements govern confidentiality and data destruction. Our privacy policy sets all of it out.

Only the team members assigned to your engagement, through named and logged accounts that are revoked as soon as the work ends. No account is shared, and no third party gets access without your written consent.

We follow our response procedure: contain the incident, assess the risk of injury, notify you without delay, fix the cause and record everything in the register. If the incident presents a risk of serious injury, the Commission d’accès à l’information and the people concerned are notified promptly, as Law 25 requires.

Write to us at support@cogio.ai with a description of the problem and the steps to reproduce it. We acknowledge receipt within 48 hours on business days, and we take no legal action against good-faith researchers.