Home · Products · Vendor review

Vendor review and security

What your procurement, risk or security team needs to approve Crown Intelligence as a vendor: company details, policies, documents and subprocessors, in one place. Crown Intelligence is operated by Crown Stack Systems Inc., Oshawa, Ontario. Where an answer is not ready yet, we say so.

Company and contacts

Legal name: Crown Stack Systems Inc., operating as Crown Intelligence
Registered address: 1230 Oakhill Avenue, Oshawa, Ontario L1K 2R4, Canada
Governing law: Ontario and the federal laws of Canada applicable there
Vendor questions: [email protected]
Privacy Officer: [email protected]
Company details: Company information

Policies

Document	What it covers	Status
Terms of use	Use of the site and the free services	Draft, counsel review
Data licence	Downloads, exports and attribution	Draft, counsel review
Privacy notice	Personal information within the compiled data	Draft, counsel review
Commercial licence summary	Screening and reseller / OEM licences	Draft, counsel review
Source attribution	Crediting publishers, "as of" dates	Draft, counsel review

To be provided: the final data processing agreement once approved, and a privacy policy covering website visitors and customer account and billing data (the current privacy notice covers only personal information inside the compiled records).

Compliance

Our privacy notice addresses PIPEDA, Quebec's Law 25 and the Alberta and British Columbia private-sector privacy acts for personal information that appears in public records. It also states that the service is not a consumer report under the US Fair Credit Reporting Act.

To be provided: any security certification or attestation actually held (for example ISO/IEC 27001 or SOC 2), with certificate scope and dates. No badge is shown until one exists.

Documents on request

Vendor-onboarding documents are shared on request rather than through a gated portal. Ask at [email protected].

To be provided: which of these exist and can be shared: corporate registry profile or certificate of status, GST/HST registration, US W-8BEN-E, certificate of insurance, beneficial ownership (individuals with significant control) register extract, bank confirmation letter; and for security, a business continuity and disaster recovery plan, technical and organizational measures, and penetration test summary.

Technical and organizational measures will be published at technical and organizational measures, and our security approach at security.

Data we hold

Public-record data. Sanctions, PEP, debarment, registry and ownership records, including personal information published by official sources. Handled as described in the privacy notice.
Screening queries. The API reference states that query bodies sent to the matching endpoint are not stored.

Data hosted in Canada. Crown Intelligence data is hosted in Canada.

To be provided: the categories of customer and visitor data collected (contact, billing, server logs), and how long each is kept.

Subprocessors

Service providers that process data on our behalf, with where they process it.

Name	Category	Region	Purpose
No list published yet.

To be provided: the actual hosting, infrastructure, email, CRM, payment and accounting providers, their regions, and the safeguard used for any transfer outside Canada.

Security controls

To be provided: the control framework in use and the controls implemented, by area: infrastructure, organizational, product, internal procedures, and data and privacy. No controls are listed until they are confirmed.

Security questions

Where are your servers located?

In Canada: our data is hosted in Canada. To be provided: the hosting provider and data-centre region.

I found a security issue. How do I report it?

Write to [email protected] with "Security report" in the subject and do not include exploit details in public channels. To be provided: a disclosure policy and whether a bug bounty is offered.

Do you keep the names we screen?

The API reference states that query bodies sent to /api/match are not stored. For full control, the data can be run inside your own environment: see on-premise deployment.

Do you support single sign-on?

There are no customer accounts today, so there is nothing to sign in to. See how access works.

Do you support OSFI Guideline B-10 third-party risk reviews?

Send your third-party risk questionnaire to [email protected]. To be provided: a prepared B-10 response pack, if one will be maintained.