Privacy & Security

CovioIQ is built from the ground up to protect your clients' data, and is designed to align with Canadian privacy law. Your records are stored in Canada and every table carries row-level security.

PIPEDA Compliance

The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada's federal privacy law. CovioIQ's practices are built around its 10 fair information principles; how each one is handled:

Consent (4.3): Your clients' data is only used for insurance broker operations. We never sell or share it.

Safeguards (4.7): All data is encrypted at rest (AES-256) and in transit (TLS 1.3).

Retention (4.5): Data is retained only as long as necessary. You can delete it anytime.

Access (4.9): Your clients can request their data or corrections at any time.

Encryption Standards

Data at Rest: AES-256

All contact data, policies, and PII stored in our database is encrypted using AES-256, the same standard used by banks and governments.

Data in Transit: TLS 1.3

All communication between your browser and our servers uses TLS 1.3 encryption. No data is ever sent unencrypted.

Data Storage & Location

Hosted in Canada: All client data is stored on Canadian servers operated by Supabase (AWS ca-central-1 region, Montreal).

Processing outside Canada: Storage is Canadian, but some service providers process limited data outside Canada — the AI model provider for the optional AI features, the SMS provider, payment processing and transactional email. Each one, what it handles and where it is located is listed on our Subprocessors page.

Backups: Daily encrypted backups with 30-day retention. Point-in-time recovery available.

Access Control: Role-based access control (RBAC) ensures brokers only see their own agency's data. Database-level row-level security (RLS) prevents unauthorized access.

Third-party certifications. CovioIQ has not yet completed certification audits such as SOC 2 or ISO 27001. We're happy to walk enterprise prospects through our current security controls and certification roadmap.

For enterprise customers requiring BAA (Business Associate Agreement) or custom data residency, contact compliance@covioiq.com.

Questions about our security practices?