What we do today
- Canadian data centre. Records and uploaded files are stored in Montréal, and our application servers run there too. Pages are delivered through a global network, so requests can pass through it in transit. See the Sub-processors page for every service provider.
- Organization isolation. Every table that holds customer data uses database row-level security, so one organization's users cannot read or change another's. We test this with a two-organization suite on every change.
- Locked engagement records. Once an engagement record is submitted, it is locked. A correction is saved as a separate, dated record that points at the original.
- Audit trail. Changes to profiles and engagement records are recorded in an audit log, with the team member who made each change. Entries can't be edited or deleted once written.
- Export ledger and checksums. Each export is logged in an append-only ledger with a hash chain. Export bundles include a manifest and SHA-256 checksums so a recipient can confirm that files match what we produced. A checksum shows a file has not changed since export. It does not prove who wrote the content.
- Encryption. Data is encrypted in transit and at rest by our hosting providers.
- Two-factor sign-in on every account. Every member sets up an authenticator app the first time they sign in, and every sign-in after that asks for a 6-digit code. Once an account has been set up, the database refuses that account's data to any session that hasn't passed the code, so a stolen password on its own can't open it. There are no recovery codes: an administrator in your organization can reset a member who loses their phone. A reset also signs that member out on every device, and they set up a new authenticator when they next sign in.
- Access control. Roles separate administrators, members and viewers, with a session timeout after 30 minutes idle, rate limiting on sign-in and exports, and security headers on every response.
- Optional AI is off for new organizations until an administrator turns it on. Natural-language reporting and email-draft suggestions run only while it is on. We do not use your data to train AI models.
What we do not claim
- No SOC 2 report of our own. Our hosting providers, listed on the Sub-processors page, publish their own independent audit reports. Melyn Management Inc., which runs StakeholderHub, has not been audited or certified against SOC 2, ISO 27001 or any similar standard.
- No OCAP® certification. We store Indigenous nation records so that the customer keeps ownership and control of them. We have not been reviewed by the First Nations Information Governance Centre.
- No legal advice and no compliance guarantee. StakeholderHub organizes and exports engagement evidence. Whether that evidence meets a duty, a regulator's requirement or a court's standard is a decision for you and your counsel.
- No single sign-on and no hardware security keys yet. Two-factor sign-in uses an authenticator app.
- No absolute security. No system is completely secure. If a breach affects your data we will tell you promptly.
Questions and security reports
Security questionnaires and vulnerability reports go to hello@stakeholderhub.ca.