The technical and organizational safeguards we can show today, and the ones still to be documented.
This page lists the measures that protect the Crown Intelligence service and the personal information in it, in the spirit of Principle 4.7 (Safeguards) of the Personal Information Protection and Electronic Documents Act. It states only measures we can show: those in our privacy notice and those visible in the service itself. Everything else is marked as still to be provided.
Draft. The privacy notice this page relies on is a draft pending review by Canadian counsel. Nothing here is a certification or audit result.
Confidentiality
Premises and hosting
To be provided: Where the service is hosted (providers and regions), physical security of premises, and the list of subprocessors with their locations, which the privacy notice says will be published before launch.
System access
Measure
Status
Basis
Access to personal information limited to personnel on a need-to-know basis
Stated
Privacy notice §8 (draft)
The data service reaches the database over SSH with key-based authentication
In the code
Data service source
Authentication, multi-factor, password management, device encryption and screen locking for staff
To be provided
—
Data access
Measure
Status
Basis
The public API is read-only: it offers no route that changes records
In the code
Data service source
Request values are escaped and length-limited before they reach the database
In the code
Data service source
Role-based access control, account management and deployment credentials
To be provided
—
Separation of data
Measure
Status
Basis
Screening records and reference records (companies, owners, securities, vessels) are held and counted separately
Automated quality checks that stop a faulty build, and rollback of releases
To be provided
—
Production network
Measure
Status
Basis
Network segmentation, firewall and outbound (egress) rules, protection against denial of service, flow logging, keeping the database off the public network, server hardening and patching schedule
To be provided
—
To be provided: How the production network is laid out and protected: segmentation, firewall and egress rules, denial-of-service and web application firewall protection, network logging, whether the database is reachable only on a private network, hardening standards and how quickly security patches are applied.
Availability and resilience
Measure
Status
Basis
Read-only answers are cached for up to 10 minutes, so repeated questions do not reach the database
Backups, restore testing, monitoring and alerting, on-call, disaster recovery objectives
To be provided
—
To be provided: Availability targets and any service level (the 99.9% figure in the licence summary is a proposal only), status page, and incident history.
Regular testing and evaluation
To be provided: Certifications held or pursued (for example ISO 27001 or SOC 2), penetration tests, disaster-recovery exercises and dependency scanning. The privacy notice says certifications will be summarized in a trust centre.
Organizational measures
Measure
Status
Basis
Security training for staff and contractors
Stated
Privacy notice §8 (draft)
A Privacy Officer handles access and correction requests
Service providers process data only on our behalf under confidentiality and security obligations
Stated
Privacy notice §6.2 (draft)
Confidentiality agreements, risk assessment, business continuity plan, incident response and breach notification procedure
To be provided
—
Protection by design
Measure
Status
Basis
Encryption in transit and at rest
Stated
Privacy notice §8 (draft)
Use limited to compliance screening, due diligence, legal and investigative uses and running the service; no behavioural advertising and no sale to data brokers