A secure platform, designed for Canadian organizations

Cyberimpact holds a SOC 2 Type 2 attestation, validated by an independent auditor.
This attestation confirms that our security and privacy controls are rigorous, well designed, and effective over a period of time.

We apply strict practices for risk management, access reviews, and logging of sensitive actions, in accordance with industry best standards.

Your data is hosted in Canada, in a data centre that also holds a SOC 2 Type 2 attestation.

The facilities are protected by continuous monitoring, strict access control, and high-security physical measures.

• Our infrastructure relies on multiple layers of protection, including:
• application firewalls (WAF);
• an intrusion detection system (IDS);
• DDoS protection mechanisms;
• network segmentation;
• data encryption;
• encryption of storage disks.

Cyberimpact designs and operates its application services based on a controlled architecture and internal components for data processing. Unlike some platforms, we limit reliance on third-party providers for critical data-related functions, which strengthens control, security, and data protection.

We regularly perform penetration tests, automated vulnerability scans, internal reviews, and proactive security patch management. These continuous assessments allow us to adapt our defences to emerging threats.

Identified vulnerabilities are prioritized based on their level of criticality and remediated within defined timelines.

Access to data follows the principle of least privilege, and sensitive actions are logged to ensure full traceability.

Access to internal environments is limited to a restricted number of authorized employees.

We apply strong password policies, require multi-factor authentication (MFA) for our employees, and conduct regular access reviews.

Our team applies secure development practices, including code review, static analysis, and regular updates of components and dependencies (security patches).

All new employees undergo an onboarding process that includes mandatory training in information security and data protection.

This step ensures that each team member understands their responsibilities regarding security from day one.

Ongoing cybersecurity awareness training is provided to all staff, including simulated phishing campaigns to strengthen reflexes against common threats.

Technical teams also receive specialized training, particularly in application security (OWASP).

All communications are encrypted via TLS 1.2/1.3. Data is also encrypted at rest using recognized algorithms (AES-256).

Account security is strengthened by password policies aligned with OWASP and NIST recommendations.

All users must use multi-factor authentication (MFA), and organizations can enable Single Sign-On (SSO).

Cyberimpact offers three levels of access: administrators, users, and users with custom permissions, enabling fine-grained and secure access management.

Only account administrators can create and manage API tokens and modify user information.

Protection against suspicious login attempts
Cyberimpact automatically detects abnormal behaviour during login.

If multiple failed attempts occur within a short period, protection measures are triggered (e.g. password reset request or temporary access restriction) to block unauthorized access while allowing legitimate users to recover their account.

Session management
User sessions automatically expire after a period of inactivity and are subject to security controls to limit the risk of unauthorized access.

Security begins within our own work environments.

Internal endpoints are protected by:

• full disk encryption;
• anti-malware and EDR (Endpoint Detection & Response) solutions;
• regular security updates and patches;
• centralized device management;
• the ability to quickly revoke access.

Access to our internal environments is based on a Zero Trust Network Access (ZTNA) model, in accordance with modern security best practices.

Cyberimpact applies strict practices to protect personal information and its clients’ data.

Data is not sold or shared with third parties for commercial purposes. It may be processed by authorized subprocessors as part of service delivery. No international transfer is carried out unless explicitly requested or required contractually.

Our processes comply with Law 25, PIPEDA, GDPR, and best practices in privacy management.

Access and activity logs are retained for a defined period to ensure traceability, facilitate incident investigations, and meet compliance requirements.

Cyberimpact has designated a person responsible for the protection of personal information in accordance with the requirements of Law 25.

For any questions regarding the protection of personal information or to exercise your privacy rights, you may contact:

Geoffrey Blanc
General Manager and Officer in Charge of the Protection of Personal Information
privacy@cyberimpact.com

Information security and the protection of personal information at Cyberimpact are overseen at the management level.

They are based on documented policies, established governance mechanisms, and regular independent assessments aimed at ensuring the effectiveness of the controls in place.

Cyberimpact helps you comply with CASL through built-in tools: consent management, subscription records, timestamped history, and compliant unsubscribe mechanisms.

We also apply administrative, technical, and organizational measures to comply with Law 25 and PIPEDA.

For organizations subject to GDPR, Cyberimpact supports the right of access, portability, the right to erasure, and transparency of processing.

Our platform is based on a modern architecture with isolated environments and databases dedicated to each client.

Continuous monitoring analyzes performance, availability, and abnormal behaviour to quickly detect any potential incident.

Platform availability and ongoing incidents are published on our status page: status.cyberimpact.com.

We perform daily backups, encrypted in transit and at rest, and stored in a separate site.

Quarterly restoration tests ensure our ability to effectively recover data in the event of an incident.

A disaster recovery plan defines the actions to be taken in critical situations.

Cyberimpact maintains a formal security incident management process.

In the event of a confirmed incident impacting data confidentiality or service availability, affected clients are informed in accordance with applicable contractual and regulatory obligations.