Security & Compliance
Your data is hosted in Canada, encrypted, and isolated per agency with row-level security. CovioIQ does not yet hold a compliance certification such as SOC 2 or ISO 27001.
Security Certifications & Compliance
Certification status
Not yet SOC 2 or ISO 27001 certified. Controls are designed around recognized criteria — security, availability, confidentiality, and privacy — but no third-party certification audit has been completed. Ask us for current security documentation.
Defense in Depth
Encryption in transit and at rest, database-enforced tenant isolation, least-privilege access, and audit logging. Third-party certifications (ISO 27001, SOC 2) are on the roadmap — not yet held.
PIPEDA Aligned
Designed to meet the requirements of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
Canadian Data Residency
Primary database and documents are stored in Canada (Supabase Montréal region). Some subprocessors — payments, transactional email, analytics — operate in the US; see our subprocessors page for the complete list.
Comprehensive Security Features
Data Encryption
Encryption in Transit
TLS 1.3 with perfect forward secrecy for all data transmission
Encryption at Rest
AES-256 encryption for all stored data and backups
Row-Level Security
Agency-scoped access enforced by the database on every table
Access Control
Secure Email Authentication
Supabase Auth with secure session management and password reset
Tenant Isolation (Row-Level Security)
Every table enforces agency-scoped access at the database layer — one brokerage can never read another's data
MFA, role-based permissions & SSO — on the roadmap
Not yet available. Ask us for current status before relying on these controls.
Monitoring & Detection
Platform monitoring
Infrastructure and authentication are monitored continuously by our hosting provider. CovioIQ is a small team without a 24/7 staffed security desk.
Intrusion Detection System (IDS)
Advanced threat detection using AI-powered anomaly detection
Comprehensive Audit Logs
Immutable logs of all system access and data modifications
Incident Response
Incident response
Security reports go to admin@covioiq.com and are triaged directly by the team that builds the product.
Breach Notification
Our own target is to tell affected brokerages within 72 hours of confirming a reportable incident. PIPEDA itself requires reporting and notification as soon as feasible once a breach is found to pose a real risk of significant harm — it sets no fixed 72-hour deadline.
Disaster Recovery Plan
RTO: <4 hours, RPO: <1 hour with multi-region backups
Infrastructure & Network Security
Data Centers
- • Hosted on Supabase, running on AWS
- • AWS Canada (Central) region, ca-central-1 — Montréal
- • Physical security, access control and environmental controls are managed by AWS at their facilities
- • We do not currently publish an uptime SLA
Network Security
- • Next-gen firewalls (NGFW)
- • DDoS protection (Cloudflare)
- • Web Application Firewall (WAF)
- • Network segmentation
- • VPN for remote access
- • Regular penetration testing
Application Security
- • Secure development lifecycle (SDL)
- • Code review and static analysis
- • Dependency vulnerability scanning
- • Regular security updates
- • Input validation & sanitization
- • OWASP Top 10 compliance
Backup & Disaster Recovery
Automated Backups
- ✓Continuous incremental backups
- ✓Full daily backups at midnight
- ✓30-day retention period
- ✓Encrypted backup storage
Multi-Region Redundancy
- ✓Daily encrypted backups
- ✓Canadian Supabase region (Montréal)
- ✓Automatic failover
- ✓Point-in-time recovery available through our database provider
Fast Recovery
- ✓RTO: < 4 hours
- ✓RPO: < 1 hour
- ✓Point-in-time recovery
- ✓Quarterly DR testing
Regulatory Compliance
🇨🇦 Canadian Compliance
- ✓
PIPEDA (Personal Information Protection and Electronic Documents Act)
Built around PIPEDA's requirements. Compliance is shared: it also depends on your brokerage's own consent practices, access controls and handling of client information.
- ✓
Provincial Privacy Laws
Practices designed around Quebec Law 25, BC PIPA and Alberta PIPA requirements
- ✓
Canadian Data Residency
Primary database and documents are stored in Canada (Montréal). Some subprocessors — payments, transactional email, analytics and the AI model provider for Alex — operate in the US; see our subprocessors page for the complete, honest list.
🏢 Insurance Industry Standards
- ✓
Built for provincially regulated brokerages
Record keeping, retention and audit features are designed to support your obligations under provincial insurance regulation. Licensing and conduct obligations remain the brokerage's.
- ✓
Record Retention
Client, policy and document records are kept for as long as your brokerage's account is active, so they remain available for the retention periods your regulator requires. CovioIQ does not delete them on a schedule of its own.
- ✓
Document audit trail
Every document upload, change, version, deletion and restore is logged with the old and new values. Audit logging for client, policy and renewal records is on the roadmap and not available yet.
Our Security Commitment
Security is built into how CovioIQ is put together rather than added afterwards: every table carries row-level security, broker data is scoped by agency, and your records are stored in Canada. We are a small team, so we would rather tell you exactly what we do and do not have than imply a security department we have not hired.
Report a Security Issue
If you discover a security vulnerability, please report it responsibly to our security team.
Security Email: admin@covioiq.com
PGP Key: Available upon request
Response Time: Within 24 hours
We operate a responsible disclosure program and appreciate the security community's help in keeping CovioIQ secure.
Security Resources
Subprocessor List
See all third-party service providers we use, with data locations and DPA links.
View Subprocessors →Vulnerability Disclosure
View our security.txt for responsible disclosure contact info.
View security.txt →Questions About Our Security?
Our security team is happy to provide additional details or documentation.