Built for the people who have to be sure.

Where your data lives

Karis Care runs on Canadian infrastructure, with data stored and processed in Canada. Your supported individuals' records do not leave the country in the course of normal operation. We name the provider and the region, because “hosted in Canada” means very little without them.

provider

DigitalOcean

region

Toronto, Canada (TOR1)

residency

Data at rest stays in Canada

processing

Application processing in-region

Isolation model

Each tenant gets its own database. This isn't a shared table with a tenant column — it's a real architectural boundary, so one agency's data is separated from another's at the database level.

Model: one tenant → one database

Authentication

Multi-factor authentication is built in on every account, and an administrator can require it agency-wide — enforced at sign-in, not a policy you have to chase. Users without a configured factor are sent to enrolment before they can reach anything. Session controls let administrators manage active sessions, and single sign-on (SSO) is on the roadmap for larger providers.

mfa

Built in, available on every account

sessions

Administrator session controls

sso

On the roadmap

Encryption

Data is encrypted in transit and at rest. Connections to Karis use TLS; stored data is encrypted on disk.

in transit

TLS for all connections

at rest

Encrypted storage

Access control

Access is role-based, and restrictions can be applied at the level of individual entities. Polymorphic entity-level restrictions mean a worker sees the people and programs they're responsible for — not the whole agency.

• Role-based permissions across modules.
• Entity-level restrictions on supported individuals, programs, and sites.
• Least-privilege by default.

Audit logging

Every change is tracked. The audit log records who made a change, what changed, and when — across records, not just logins.

Recorded per change: actor · action · entity · timestamp

Backups & recovery

Backups are the part of a vendor answer that is easy to assert and hard to check, so here is the architecture rather than the assurance. Every database and every tenant’s files are copied nightly to a different provider, in a different province — Amazon Web Services in Calgary, away from the Toronto region that runs the platform, and still inside Canada. An outage, a billing dispute, a ransomware event, or a mistake at our primary host cannot take the backups with it.

frequency

Nightly — database dumps at 01:00, file sync at 01:30

destination

Amazon Web Services, Canada West (Calgary) — a different provider, province, and power grid from the Toronto primary, reached with its own separate credentials

coverage

Every tenant database and every tenant’s uploaded files

immutability

Write-once for 35 days. Object Lock runs in compliance mode, which means a backup cannot be altered or deleted before then — not by an attacker, not by our own staff, not by the root account on the cloud console

write-only access

The application host holds a key that can add backups and nothing else: no delete, no retention override, no decryption. A server that is compromised cannot read or destroy what it has written

encrypted before it leaves

Every database dump is compressed and encrypted on our server, before upload. The encryption key is a public one; the matching private key is held offline and has never been on the server. A dump therefore arrives at the backup provider already unreadable — to them, and to anyone who obtains the bucket

encrypted at rest

Everything in the bucket, including the synced file store, is additionally encrypted with a key we control rather than the provider’s default. A separate restore identity is the only one permitted to decrypt it

retention

Each nightly backup is kept 365 days; superseded versions are kept 90 days, then expire automatically. When an agency leaves, its backups and file versions are deleted within 40 days of termination

point-in-time recovery

The managed database keeps a rolling 7-day point-in-time window — the fast path for an ordinary mistake, with the off-provider copy behind it for anything larger

restore procedure

Restores run from a written runbook into a throwaway database, never a live one, and every backup run writes a manifest listing each database’s size and SHA-256 so a restore can be checked rather than assumed

Those are settings, not adjectives — each one is something you could ask us to evidence. The single figure we will not invent is a contractual recovery time objective: how long a restore takes depends on how much is being restored, so we set it in your service schedule and confirm it in writing rather than publishing a number that fits nobody.

Sub-processors

We keep the list short deliberately, and we publish it rather than making you ask for it. Every provider below is contractually bound to protect what it handles and to use it only to deliver its service to us. This is the same list as section 5 of the Privacy Policy — there is one list, published in two places, so the two documents cannot drift apart.

Karis Care platform

DigitalOcean

Application hosting, managed database, and tenant file storage (Spaces) — Toronto, Canada

Amazon Web Services

Off-provider destination for database and file backups, so a failure at our primary provider cannot take the backups with it — Calgary, Canada (ca-west-1)

Stripe

Subscription billing and payment processing. Handles your billing contact and payment details — never care records — United States

Resend

Transactional email — account invitations, password resets, and notifications. Notifications leave out supported individuals’ names and anything written about them — United States

Sentry

Application error monitoring. Configured so that no personal information is transmitted — errors carry stack traces and identifiers, not record contents — United States

Cloudflare

Bot protection (Turnstile) on the public enrollment and referral form, which carries information about the person being referred — Global edge network

This website

Cloudflare

Hosting and delivery for this marketing website, plus privacy-preserving page analytics — no cookies, no cross-site tracking — Global edge network

Web3Forms

Relays this website’s demo and contact form submissions to our inbox — United States

Three of these process platform data outside Canada — billing, transactional email, and error monitoring. None of them stores your care records, though a notification email can name a supported individual and billing carries your administrators’ contact and payment details. Backups leave our primary provider but stay in Canada. The last two rows serve this marketing website and never touch the platform. If we add or replace a provider that handles personal information, we update this page and the Privacy Policy together, and customers whose agreement includes a data-protection schedule get advance notice on the terms set out there. A dated copy for your procurement file is available on request.

Continuity & exit

You are trusting a small company with records you are legally required to keep. The honest answer to “what if you go away?” is not a promise that we won't — it is making sure you are never locked in while we're here.

export

Export your reports and records yourself in open formats, any time. For a complete copy of everything your agency holds, ask — we prepare it within five business days, at no charge

exit fees

None — ever, including on the way out

retrieval window

A post-termination window to export before deletion, set in your agreement. All data, including backups, is deleted within 40 days of termination

term

Month-to-month after the initial term — no multi-year lock-in required

discontinuation

Advance written notice with full export access throughout — you will never lose access at the same moment you learn the service is ending

Compliance posture

We design to Canadian privacy law and accessibility standards. We're honest about the difference between what's designed-for and what's formally certified — so here is the uncomfortable half first: Karis Care is not SOC 2 audited and not ISO 27001 certified. Every other claim on this page describes something specific in the architecture, and we will walk your board or your IT reviewer through any of it on request.

PIPEDA

Designed for, by architecture

PIPA (BC/AB)

Designed for, by architecture

AODA / WCAG

Accessibility commitment, WCAG 2.1 AA target

SOC 2

Not audited

ISO 27001

Not certified

Breach notification

If we become aware of a privacy breach involving your data that creates a real risk of significant harm, we notify you without undue delay — what we know, what we're doing about it, and what we recommend you do. We do not wait for a complete picture before telling you something happened.

who we tell

The affected customer, directly — you decide about your own notifications

regulators

OIPC British Columbia and the OPC as the law requires

what you get

Scope, timeline, cause, remediation, and what we changed

Responsible disclosure

Found something? We want to hear about it. Report security issues to our team and we'll respond.

Security contact: support@kariscare.com