Trust pack for vendor review

Trust pack for vendor review

If your brokerage, firm, or practice runs a vendor review before approving new software, this page collects the answers in the order the questionnaire usually asks for them.

This page and the trust centre summarize practices. The Privacy Policy, Business Terms and DPA are the governing documents; this summary does not replace them.

Data residency

Client records and documents uploaded through the secure guest portal are received and stored on a server we own and operate in Ontario, Canada. Encrypted backups are kept in Ontario. We cannot guarantee that encrypted Internet traffic never crosses a national border. Our mail server is in Québec; after a message leaves it, the recipient's provider and delivery networks may process the email elsewhere. Optional Google Calendar synchronization may send event details, including client information entered in those events, to Google.

Our standard app addresses, my-id.ca and hivi-x.ca, use .ca, Canada's country-code domain, and connect to our Canadian-hosted service. A business may choose its own domain with a different ending and use a registrar or DNS provider outside Canada. We do not require its custom domain or domain-service providers to be Canadian. The domain name alone does not determine where documents are stored: a custom domain connected to our portal must still route to our approved Canadian server. Using a custom domain does not move portal document storage outside Canada. Domain/DNS services and Internet transit may involve other countries with either address option, as explained below.

Hosting, backups and recovery

• Primary hosting: client records, uploaded documents, the databases and the self-hosted AI models run on a server that we own and operate ourselves in Ontario, Canada. It is not rented from a cloud or data-centre provider, so primary hosting involves no sub-processor. MongoDB, PostgreSQL and the internal APIs the app calls listen only on the server's loopback interface, so they cannot be reached from the network.
• Backups: every night the main database, the chat database, stored files and service configuration are backed up into one archive. Each archive is encrypted to two keys that are kept off the server, so the server that writes the backups cannot read them. The last seven nightly archives stay on the server, and archives are also copied to a separate external drive. Backups stay in Ontario.
• Recovery point: backups run once a day, so if the server were lost, changes made since the last nightly backup (up to 24 hours) could be lost.
• If the server fails: production runs on one server with no standby copy. We rebuild it on replacement hardware and restore the latest backup by following our written restore procedure. The service is unavailable until that restore is complete.

Branded client portals

An eligible business can use its own subdomain, logo and colours for borrower-facing document and signing links. We check domain ownership, routing to the approved Canadian ingress and HTTPS before activation and afterward. If these checks fail, new links use the platform address. The business controls its linked privacy notice; hivi-x still operates the portal and processes data for that business. Transactional email may display the business name and reply-to address, but the sending address stays on the platform domain.

Domain and certificate services. Custom-domain setup uses DNS lookups and Let's Encrypt (Internet Security Research Group, United States) for HTTPS certificates. These services receive the hostname and technical validation data, such as server addresses and DNS records; we provide our operations contact for certificate management. Certificate names are published in public Certificate Transparency logs and may remain there after domain removal. These services may process this metadata outside Canada; we do not send borrower documents or verification codes to them. Do not include a client's name or other confidential information in your portal hostname. See Let's Encrypt's privacy notice.

Encryption

• At rest: AES-256-GCM. Sensitive fields are encrypted in the database.
• In transit: HTTPS with TLS 1.2 or 1.3 between the browser and the public ingress. Behind the ingress, services on the same server talk over the local loopback interface without TLS; that traffic doesn't leave the machine, and the app refuses to start if an internal service is configured on another machine without TLS. Email leaves the server over TLS to our mail server in Québec, and the connection checks that server's certificate.
• Passwords: hashed with bcrypt; never stored in plain text and never visible to operators.
• Two-factor secrets: TOTP shared secrets are encrypted at rest with the same AES-256-GCM scheme.

Authentication controls available to your staff

• Password with TOTP two-factor authentication.
• Passkeys (WebAuthn) — phishing-resistant, with the private key never leaving the device. A passkey is bound to a single domain, so staff who use both hivi-x.ca and my-id.ca register one on each.
• Optional "Sign in with Google".

Staff access and permissions

• Own login per person. Each member of a team workspace signs in with their own account; logins are never shared.
• Three roles. The owner holds billing; admins manage people, workspace settings and firm templates; staff add and work on clients but can't delete clients, import or export in bulk, edit firm templates or branding, see the activity log or change billing. hivi-x checks each permission on the server, not only in the screen.
• Assigned clients only. The owner can set staff to see only the clients assigned to them, with those clients' checklists, uploads, signature requests and links. The owner and admins always see everything.
• Co-agents from another firm join one client for free and see only what you share with them.
• Activity log. The owner and admins can review and export what each member did, and see each member's sign-ins.
• Leaving. Removing a member ends their access at once and signs them out.

See Team workspaces and roles for the full role table.

AI processing

All AI that touches customer data — extraction, search, form mapping, document checks — runs on infrastructure hivi-x operates. Customer data is not sent to OpenAI, Google, Anthropic, or any other third-party AI provider.

Every AI-suggested value is presented as a draft for a human to review before it is saved or sent.

Sub-processors

The current list is published on the trust centre and is short by design:

None of these are used for AI inference. The trust centre is updated when the list changes, and we will email you directly on request.

Data processing agreement

The DPA is public. If your review needs a signed copy, email the privacy address listed on the trust centre and include the legal name of the contracting entity.

Privacy law position

• Practices are designed against PIPEDA. hivi-x does not claim a PIPEDA certification — no standard certification of that kind exists.
• Access, correction, export, and deletion rights under PIPEDA, Quebec Law 25, and GDPR are exercised through Data Requests.
• hivi-x does not hold a SOC 2 report, or a third-party attestation against HIPAA, PHIPA, or GDPR. If your review requires one, say so early — we will tell you plainly what we can and cannot sign rather than let a procurement cycle run on a false assumption.
• No independent penetration test has been carried out yet. We have written the scope for one and a SOC 2 readiness plan; dates are added to the trust centre once they are committed.

Retention and deletion

• Data is retained while the account is active.
• Account deletion removes profile data, uploaded files, and templates from active databases.
• Encrypted backups may retain data deleted from active systems until rotation. Timing must be confirmed for your request; erasure within 30 days is not guaranteed here.
• Stripe retains billing records on its side as required by tax and payment regulation.

A subscription lapsing is not a deletion event: if a trial ends or a plan is cancelled, client files, checklists, and uploads are retained — access to the workspace is what pauses. See Business trial and billing.

Incident notification

• We notify affected businesses without undue delay after becoming aware of a breach affecting their data. Individual and regulator notifications follow applicable legal deadlines; PIPEDA requires notice as soon as feasible for a breach posing a real risk of significant harm.
• A public post-mortem is published on the trust centre.
• Incidents meeting PIPEDA's "real risk of significant harm" threshold are reported to the Office of the Privacy Commissioner of Canada.

Incident history to date is published on the trust centre.

Client-side access

Clients of your business do not need an account to send you documents. A guest link is scoped to one client of one business, verified with an emailed one-time code, and expires. See Send your first guest link for what the client experience looks like and what the link does and does not expose.

Related

• Trust centre — the source of truth for every claim above
• Privacy Policy
• Business Terms
• Data Requests

Guest-upload checks

New photos sent through guest links can be read by the model hosted on our infrastructure. No third-party AI provider is added. These optional checks use the business’s existing capacity limits, with limits per link and business, and wait behind regular account requests. If the model, queue or a limit prevents a check, the upload stays accepted. Measured and PDF checks still run when available; the business sees that automatic checks were incomplete or unavailable. Warnings do not approve documents.