What happens to confidential information when you hand it to an AI
This page answers the question every professional bound by confidentiality asks: where exactly does what I type go, who can read it, how long is it kept, and what am I on the hook for if I get it wrong. It is written to be checked — every claim points to a contract clause, a statutory text, or a policy published by the provider concerned.
Last reviewed:
Your data exists in three states
Data goes through three moments: while it sits stored with you, while it travels, and while a model reads it to answer. The first stays in Canada. The second is encrypted end to end, but let us be exact: the hop that reaches the model provider crosses the border along with its contents — encrypted, but outside. The third is the one no encryption can protect, since the model has to read your text in order to answer it. So it is a question of contract, not cryptography.
- 1 · At rest
In your instance, in Canada
Everything the platform keeps — conversations, documents, knowledge bases, indexes — is written to an instance dedicated to your organization, hosted on Microsoft Azure in Canada: the Canada Central (Toronto) region. If an obligation requires Quebec, private hosting is what answers it — the shared cloud offers only one Canadian region today.
- Dedicated instance: no application database shared between customers
- Encryption at rest provided by the hosting platform
- Connector credentials additionally encrypted at the application layer
- Operational secrets in a key vault with role-based access control
- Continuous archiving (WAL): 30-day point-in-time recovery, plus a 14-day undelete window
- 2 · In transit
Encrypted on every hop
Between your browser and your instance, then between your instance and the model provider, everything travels over TLS 1.2 or higher. Transport is never in the clear, including on error responses. The first hop stays in Canada; the second leaves it as soon as the chosen provider operates elsewhere.
- TLS 1.2+ across all flows
- HSTS with preload; security headers present even on error responses
- Content Security Policy, framing refused outside your own domain, referrer restricted
- TLS protects the journey, not the destination — that is the third state
- 3 · In use
At the model provider, for one request
For a model to answer, it has to read your question and any documents attached to it. That content is transmitted, readable by the model, to the provider selected for that request — several of which operate in the United States. No encryption changes this. What governs it is contractual commitments and routing settings.
- Sent for the duration of the computation, then the answer returns to you
- No use for training a public model without your written authorization, by contract
- Depending on the provider: no retention, up to 30 days, or a period they do not publish — the console then shows “unknown”
What the others do, and what we do
“Where does my data go” is a question for every AI tool, not just ours. Here is where the market stands on 9 August 2026, taken from each vendor's own published documentation — not from our pitch.
| Tool | At rest | At compute |
|---|---|---|
| Microsoft 365 Copilot | Yes — covered by the data-residency commitments since 1 March 2024. | No for the computation: Microsoft's documentation states that “customers outside the EU may have their queries processed in the US, EU, or other regions”. The European Union gets a data boundary; Canada does not. |
| ChatGPT Enterprise | Yes — Canada is among the regions offered. | Separate for the computation: OpenAI treats data residency and “inference residency” as distinct, and inference is not covered by the same region choice. |
| Google Workspace and Gemini | No — the regions on offer are the United States or Europe. Canada is not an option. | Processing follows the same rule: United States or EU. |
| Claude (Anthropic) | Anthropic publishes no regional residency option for Claude. | Available with residency through Amazon Bedrock or Google Vertex, but then the commitment belongs to the cloud, not to Anthropic. |
| HiloIntelligence | Yes — an instance dedicated to your organization, Azure Canada Central. It is the database BACKUPS that are geo-replicated to the paired region, Canada East; the instance and its database live in Canada Central only, and the files you upload do not leave that region. Not a service shared between customers for your data at rest — two exceptions: meeting capture goes through a pooled bot fleet, and our billing control plane is also shared between deployments. | The computation leaves for the selected model provider, exactly as it does everywhere else. The difference is that we say so, we name the route, and the console shows each provider's policy. What those two shared services hold: the fleet writes a meeting's audio and transcript to disk before handing them to your instance, and if delivery fails they wait there with no maximum delay, then move to a quarantine kept for inspection, and the billing plane receives each person's name, email and usage measurement — with no documented retention period as yet. |
Nobody on this list runs your queries in Canada. What actually separates these offers is what they keep here and what they tell you about it. On the first, we are the only one shipping a dedicated instance rather than a share of a shared service; on the second, we chose to describe the whole route rather than leave it in a footnote.
The journey of a single question
Step by step: what each link keeps, and what it lets go.
- 1
Your browser
The user writes a question and may attach a document. The session is a signed token, revocable server-side.
- What stays here
- Nothing durable: the display only
- What leaves
- The question and attachments, over TLS, to your instance
- 2
Your HiloIntelligence instance
The instance checks the user's rights, applies the model-access and document-access rules, records the message, then composes the request.
- What stays here
- The conversation, documents, index and audit log — in Canada, on your side
- What leaves
- The composed request, plus the author's directory record (name, email, job title, department, work contact details) wherever those fields are filled in
- 3
The Hilo Tech Router
Our routing layer selects the endpoint for the requested model and forwards the request. It relies on a third-party aggregation service, whose identity is disclosed under a confidentiality agreement and whose processing takes place outside Canada. That service does not retain prompts by default; it does retain technical metadata such as token counts and latency.
- What stays here
- Technical metering and billing metadata
- What leaves
- The request, on to the selected model provider
- 4
The model provider
The model reads the request and produces the answer. It is the only link that must see your content in the clear. Retention terms differ: some keep nothing, others keep a few weeks for abuse detection. The admin console shows each provider's published policy.
- What stays here
- Depending on the provider: nothing, or a temporary safety retention
- What leaves
- The generated answer, back along the same path
- 5
Back in your instance
The answer is stored in the conversation, attributed to the user and the budget, and becomes readable. From that moment it is data at rest again, in Canada.
- What stays here
- The answer, the cost, the attribution, the audit trail
- What leaves
- Nothing
How we choose AI providers, and what constrains them
A model is not chosen because it is popular. It is chosen because its contractual terms are compatible with confidential content, and because you can verify that fact without taking our word for it.
Who the providers are, and in which country
A model is built by a lab, but the computation is run by someone else — and it is that second organization your assessment has to appraise. An Anthropic model can be served by Amazon Bedrock, a Google model by Azure. The table below names the main execution providers, with their country and their policies; the deployed list holds one more. Only one sits outside the United States and France, and its use is limited to video generation. The routing layer processes in the United States; we disclose its identity under a confidentiality agreement, before signature.
The execution providers named, with country and policies; the deployed list on request
The provider can change without anyone choosing it
It has to be said, because it is the easiest point to miss in an assessment. A model policy is an ORDERED chain: if the provider at the head returns a rate limit, a server error or nothing at all, the platform replays the request on the next one. And if the request exceeds the chosen model's window, it switches to the smallest model able to hold it — same family first — and says so in the conversation. Consequence for s. 17: the destination state can change mid-request, with no human decision. Your assessment must therefore cover the WHOLE chain you leave enabled, not just the model shown by default — and that is precisely why the catalogue is restrictable: a policy that contains only providers you have assessed cannot take you somewhere else.
Fallback chain visible and restrictable — no switch to a provider you have removed
One way out
No part of the platform calls a provider directly: all outbound traffic goes through a single routing layer, one HTTP client, no provider SDK in the code. One distinction we have to draw ourselves, because it is verified by reading the code and not this page: a single exit point for TRANSPORT is not a single control point for ENTITLEMENTS. Some fifteen modules call the routing layer without going back through the access check — see the next box. One exception we have to name: the Office document translator opens its own HTTP client and does not go through this guardrail. It is the only outbound path that escapes it, and that is why we speak of a single routing layer rather than a single client.
A single routing layer — one named exception, the Office translator
Every provider's policy, shown in your console
For each provider, the admin surface shows whether it may train on prompts, whether it retains them, for how many days, whether it may publish them, and whether it requires a user identifier. Values are read live, not copied by hand. One honest reservation: that console is our verification mechanism, and it is the one piece you cannot open from this page. Ask for it in a demo before you sign (the guided product tour is at the end of the “Demo” link in the navigation bar) — the providers screen takes a few minutes to show, and that is the right way to check these claims rather than take our word for them.
An unknown policy renders as "unknown", never as "no"
The catalogue is restrictable
An administrator can make a model invisible and unusable — by group, by named user, for administrators only, or for everyone. The refusal happens at call time, not just in the picker, and it binds administrators too. The limit, and it matters: the switch binds the models a USER picks, not the handful of calls the SERVER makes on its own. Some of those carry real content — extracting the text of a document added to a knowledge base or pulled from a connector, the Law 25 detector, the conversation title, the agent's screenshot, AI-assisted email. In other words: restricting the catalogue is not enough to guarantee that an excluded provider will never see confidential content. That is the most important gap on this page; it is on our roadmap, with no date announced.
Binds every model a user picks; not yet the server's own calls
What the provider learns about your people, and what it may not do with it
The preamble sent to the provider identifies the author: their name and email, plus whichever directory fields are filled in (job title, department, office, phones, work address). That is what lets the model write in their name, and it belongs in your impact assessment — the provider does not train on these exchanges, but it does receive them. A service key changes nothing here: the preamble carries the record of the administrator who created the key. The name given to the key does go to the provider, but in the billing attribution field, not in the preamble's identity: it groups reports together, it replaces no one.
Normalisation enforced at the egress point, on every path
No training on your data, by contract
The master agreement forbids using your confidential information to train a public AI model without your written authorization, and provides that the platform is configured by default with providers whose terms do not permit it. One exception worth knowing: at one of the named providers, the API's unpaid tier permits training on and human review of prompts; only the paid tier carries the no-training commitment. Ask us in writing which tier your instance is on.
Master agreement, clauses 14.2 and 14.7
If you step outside the recommended configuration, you know it
You can enable a model we do not recommend. The contract is explicit: verifying that provider's terms then falls to you. That is exactly why the console publishes the policies — so the choice is informed rather than implicit.
Master agreement, clause 14.7, second paragraph
The execution providers, and what each one commits to
These are the companies that actually run the computation — distinct from the labs that build the models. The table names the ones that serve the models in your catalogue; the deployed allowlist holds one more, which we provide on request. A word on who controls it, because the console misleads: there is a setting of that name in your console, but it only filters what the providers tab displays and has no effect on which models are actually reachable. The effective list is set at deployment, with us.
| Provider | Contracting entity | Country | Training | Retention | Policies |
|---|---|---|---|---|---|
| Microsoft Azure | Microsoft Corporation | United States | No training | Not retained | TermsPrivacy |
| Amazon Bedrock | Amazon Web Services, Inc. | United States | No training | Not retained | TermsPrivacy |
| Anthropic | Anthropic PBC | United States | No training | Retained 30 d | TermsPrivacy |
| OpenAI | OpenAI OpCo, LLC | United States | No training | Retained 30 d | TermsPrivacy |
| xAI | X.AI LLC | United States | No training | Retained 30 d | TermsPrivacy |
| Perplexity | Perplexity AI, Inc. | United States | No training | Not retained | TermsPrivacy |
| Mistral AI | Mistral AI SAS | France | No training | Retained 30 d | TermsPrivacy |
| Google AI Studio | Google LLC | United States | No training | Retained 55 d | TermsPrivacy |
| Google Vertex AI | Google LLC | United States | No training | Not retained | TermsPrivacy |
| ByteDance Seed* | BytePlus Pte. Ltd. | Singapore | No training | Not retained | TermsPrivacy |
| DigitalOcean | DigitalOcean, LLC | United States | No training | Not retained | TermsPrivacy |
* Used only for video generation, never for text or chat. The contracting entity is incorporated in Singapore; its policy states storage in Singapore, Malaysia, the United States, Hong Kong, Indonesia and Japan, and contemplates lawful access by foreign authorities.
Training and retention as our routing layer reports them for your traffic, read on 13 August 2026 — this is the policy that actually applies to your requests, and it is the same one your admin console shows, live. “No duration given” means retained with no stated period, never “not retained”.
Calls leave through our routing layer, whose processing takes place in the United States, and these entities are downstream sub-processors. Retention periods and training policies are not reproduced here because they change without notice — your console shows them live.
What the contract owes you
Clause 14 of the HiloIntelligence master agreement covers data, personal information and confidentiality. It supplies the substance of the written agreement that section 17 of Quebec's Law 25 requires whenever personal information leaves Quebec — but the second paragraph wants an agreement that TAKES INTO ACCOUNT THE RESULTS of your assessment, which we do not know in advance: if yours concludes that particular measures are needed, they are recorded in an amendment. Here are its commitments, summarized faithfully.
| Clause | Commitment |
|---|---|
| 14.1 — Ownership | You remain the owner of your data. The contract transfers no ownership to us beyond the limited rights needed to deliver the service. |
| 14.2 — Purposes | Processing limited to an enumerated list of purposes, and a prohibition on using your confidential information to train a public AI model without your written authorization. |
| 14.4 — Confidentiality | Mutual obligation. If a law or order compels disclosure, we notify you beforehand where the law permits, and limit the disclosure to what is legally required. |
| 14.6 — Personnel | Access restricted to people whose duties require it, under confidentiality obligations and access controls. |
| 14.7 — Sub-processors | Default configuration uses providers whose terms do not permit training on your data. No fixed notice period is yet committed for a change of sub-processor. |
| 14.8 — Outside Quebec, outside Canada | We cooperate in documenting the assessments the law requires, including the privacy impact assessment. No guarantee of exclusive Quebec or Canadian residency is given by default: it must be written into the order form — and for Quebec that means private hosting, since the shared cloud offers only one Canadian region. |
| 14.9 — Incident | Prompt notice to your designated privacy officer, covering the nature of the incident, the people affected, the period, and the measures taken. |
| 14.10 — Verification | Audit right on fifteen business days' written notice, once per twelve-month period, at your cost unless a material non-compliance of ours is found. |
| 14.11 — Retention and deletion | Retention limited to what is necessary, standard export at end of service, deletion after the transition period. No firm deletion deadline is yet written into the contract. |
| 14.12 — Survival | Confidentiality survives the contract by five years, indefinitely for trade secrets and for as long as the law protects the personal information. |
| 27 — Governing law | The laws of Quebec and the applicable federal laws of Canada. Exclusive jurisdiction of the courts of the judicial district of Montreal. |
| GDPR — Processor role and DPA (Art. 28) | The master agreement positions you as controller and Hilo Tech as processor: enumerated purposes (14.2), confidentiality (14.4), restricted personnel (14.6), incident notice (14.9) and audit rights (14.10) — most of what Article 28 requires. Today there is neither a separate GDPR addendum nor standard contractual clauses as standard: neither one is included by default, and productising them is not scheduled — our roadmap carries them with no date. They are negotiated at the order form, case by case. We would rather say it that way everywhere than let anyone believe it is a checkbox. |
| GDPR — Transfers outside the European Economic Area | Model computation can take place outside the EEA depending on the provider selected, as documented above on this page. Standard contractual clauses (SCCs) are not yet built into our contract by default; we can add them to the order form on request. |
| GDPR — 72-hour notification window | Clause 14.9 provides for prompt notice to your designated privacy officer. GDPR sets an explicit 72-hour ceiling to the supervisory authority; that figure is not yet written separately into the contract, but our internal process aims to notify you well ahead of that threshold. |
Redaction is not what the law asks for
Many professionals redact every document by hand before handing it to an AI. It is slow, it is expensive, and in most cases it is not what Quebec's Law 25 requires. Section 18.3 expressly permits communicating personal information to a service provider, without the individual's consent, where it is necessary to perform the contract — on two conditions, both of which are about the contract: the mandate must be entrusted IN WRITING, and it must state the measures the service provider takes to protect the confidentiality of the information, to ensure it is used only to perform the contract, and to ensure it is not kept after the contract expires. The second condition therefore covers three objects — which is where the higher count you sometimes read comes from. The table below counts six of them because it brings together both limbs of the section: the two conditions that bear on the contract — the second of which carries those three objects — and then the two duties the section places on the service provider itself, to notify without delay and to permit verification.
Une personne qui exploite une entreprise peut, sans le consentement de la personne concernée, communiquer un renseignement personnel à toute personne ou à tout organisme si cette communication est nécessaire à l'exercice d'un mandat ou à l'exécution d'un contrat de service ou d'entreprise qu'elle confie à cette personne ou à cet organisme. Dans ce cas, la personne qui exploite une entreprise doit : 1° confier le mandat ou le contrat par écrit ; 2° indiquer, dans le mandat ou le contrat, les mesures que le mandataire ou l'exécutant du contrat doit prendre pour assurer la protection du caractère confidentiel du renseignement personnel communiqué, pour que ce renseignement ne soit utilisé que dans l'exercice de son mandat ou l'exécution de son contrat et pour qu'il ne le conserve pas après son expiration.
In other words: the law asks you for a contractual framework, not for scissors. Manual redaction is an expensive way to compensate for the absence of that framework — it is not what the statute demands.
| What section 18.3 requires | Where it sits in our contract |
|---|---|
| Written mandate or contract | The HiloIntelligence master agreement, signed by both parties |
| The contract states the confidentiality protection measures | Clauses 14.5 (administrative, technical and organisational measures) and 14.6 (need-to-know access) |
| The information is used only to perform the contract | Clause 14.2 — closed list of purposes, plus an express ban on training a public model without written authorization |
| The information is not kept after expiry | Clause 14.11 — deletion after the transition period, with the usual carve-outs. No fixed number of days is written in yet: this is our most visible gap here. |
| The provider notifies the privacy officer without delay of any breach | Clause 14.9 — mirrors the statutory wording, with the contents of the notice enumerated |
| The provider lets the officer carry out any verification | Clause 14.10 — audit right, fifteen business days' notice, once per twelve months |
What section 18.3 does NOT waive
- It waives consent, not the security measures proportionate to sensitivity (s. 10).
- It does not replace the privacy impact assessment: adopting an AI platform triggers two — one for acquiring an information system (s. 3.3), one for processing outside Quebec (s. 17).
- It changes nothing about the purpose rule (s. 12): information serves the purpose it was collected for.
- Minimisation remains good practice and weighs in the assessment: not redacting does not mean sending everything. Send what is necessary.
- Merely de-identified information is still personal information: section 2 covers direct or indirect identification, and re-identifying is an offence (s. 91(5)). Only anonymization within the meaning of section 23 and its regulation takes data out of the Act's scope.
Professional secrecy is a separate, stricter constraint
If you belong to a professional order, section 9 of the Charter of human rights and freedoms and section 60.4 of the Professional Code bind you on top of privacy law. Professional secrecy has no "service provider" exception like section 18.3: it is lifted by the client's authorization or by an express provision of law. The analysis is therefore different, and often more demanding.
The product's clocks
Some content deletes itself after a fixed delay. None of these clocks is configurable, none warns you before deleting, and we issue no destruction certificate. Three of them can take away a piece of a professional record; the rest touch temporary working material.
| What disappears | After how long |
|---|---|
| Transcriptions (audio to text) | The uploaded media and the extracted audio segments are deleted from disk the moment the text is produced. The text stays 30 days, then a sweep deletes the row. |
| Files produced by a tool | 7 days. Past that, the download link answers 404 and the row is deleted. |
| Attachments staged but never sent | 48 hours. A sweep reclaims files left orphaned. |
| Conversations in confidentiality mode | On leaving the page, from the browser. Safety net: 60 minutes without activity, fired the next time that same person opens their conversation list. |
| Code-interpreter workspace | 24 hours with no tool call. The conversation's directory is deleted. |
| Temporary PDF jobs | 1 hour. |
| Reusable visuals from a presentation template | 90 days. The slot then empties and the model regenerates the image. |
| Mail triage verdicts | 90 days. It is a cache, not an archive. |
| Meeting-bot join requests | 10 minutes if they go unhonoured. |
What does not expire
Conversations, documents, knowledge bases, meetings, and generated images, audio files and videos carry no clock at all: they stay until somebody deletes them. There is no customer-side retention setting — neither to shorten these delays nor to impose one. If your sector imposes a retention period or a destruction deadline, it is your procedure that holds it, not the product.
The calls the server picks itself
The catalogue restriction binds every model a user picks, administrators included. It does not bind the calls below: the server picks the model, and several of them carry real content. The list is complete as of this page's review date; a model disabled for a residency reason can still be called by one of them.
| The step | What leaves, and to which model |
|---|---|
| Text of a document added to a knowledge base | The document's pages go to openai/gpt-4o-mini, pinned in the code. No catalogue restriction applies. A file attached to a conversation, by contrast, goes through the user's own model. |
| Text of a file pulled from a connector | SharePoint, OneDrive, Google Drive: same pinned model, same absence of restriction. |
| Indexing a knowledge base | The full text of every document, split into fragments, goes to the base's indexing model — openai/text-embedding-3-small by default. The base's owner picks it, not the catalogue restriction. |
| Web search | The query goes to perplexity/sonar, pinned. The code itself notes that this call does not go through the per-user access list. Used by deep research and by the external API. |
| Image-generation web search | The query goes to openai/gpt-4o-mini, pinned. |
| Law 25 detection, if you enable it | The message text goes to the cheapest model that can hold it. |
| A conversation's title | Up to 600 characters of your message and 600 of the reply. |
| Learning centre | Course generation, auto-translation, lesson images, video transcription. The model is set by an administrator and clamped to a recommended list; it never goes through the user's choice. |
| Mail triage, if you enable it | The subject and body of the messages triaged. |
| An agent's screen capture | The screen image. This is the only one on the list where the user's preference is checked against the restriction; failing that, the organization setting or the deployment default applies. |
What “encrypted at rest” means here
The at-rest encryption of your content is the Azure platform's — AES-256, applied to disks and object storage, with Microsoft-managed keys. There is no customer-managed key, and no application-layer encryption of your conversations, documents or knowledge bases: anyone with administrative access to the database reads the text in the clear. What we do encrypt ourselves, in the application, are the integration secrets — connector OAuth tokens, API keys, MCP credentials — each under a key derived for that use alone.
Backups and regions
The database backups are geo-redundant: they replicate to Azure's paired region, Canada East, so within the province. The instance itself, its database and the files you upload stay in a single region, Canada Central by default. Restore is point-in-time from continuous archiving; a restore drill was run and passed. We do not yet document a purge delay for backups.
What you control inside the product
Compliance is not declared in a contract; it is exercised daily by an administrator. Here are the levers that exist.
Roles and permissions
Four roles — user, manager, administrator, super-administrator. An elevation policy bounds what an administrator may do, and returns to baseline with no redeployment.
Per-object access rights
Every knowledge base, prompt, tool, form, automation and assistant carries its own access rights, by user and by group. Anonymous public links are off by default; sharing outside your organization, however, is on by default, with no domain list imposed at the outset. The ceiling and the invitable domains are configurable.
Audit log
Sign-ins, impersonations and administrative acts are logged: actor, object, timestamp, IP, country. A hash-chained ledger adds password changes, passkeys, MFA, sessions and SAML — any alteration is visible. Denials, though, are not logged per actor, and the denial of an unauthorised model produces neither an entry nor a counter.
Confidentiality mode
A conversation marked ephemeral is wiped as the user leaves the page. The wipe is fired by the browser: an abrupt close can miss it, and a sweep then removes it within the hour, the next time that same person opens their chats.
Compliance detection
On every message, a scan looks for passwords, technical secrets and personal information, and offers confidentiality mode; it does not truncate its input. It is off by default — a paid option — and is itself an outbound call, to a model chosen by price, outside the catalogue restriction.
Retrospective scans
An administrator re-runs the scan over a date range and a set of users, then works the findings through a review queue. It also sends the content to the model, whatever the detection setting says, and findings survive deletion of the conversation.
Model access
The catalogue can be restricted by group, by named user, to administrators only or globally, with a kill switch that applies to administrators too. It covers what a user picks, not what the server keeps — extracting a document's text, the Law 25 detector, titling a conversation. A model disabled for a residency reason can therefore still be called.
Budgets and attribution
Consumption and cost tracked per user and per service key, with caps. Automations bill to a dedicated system user.
Sessions and identity
Server-revocable signed tokens, configurable idle and absolute timeouts, impersonation that is read-only and logged. Native MFA — TOTP, passkeys, recovery codes — enforceable by conditional-access policy, provided local accounts are enabled, which they are not by default on a single-sign-on instance. Email-code sign-in is not yet covered.
Data subject rights
An administrator locates and removes a named person's data — conversations, documents, knowledge bases — using per-object rights and the audit log. Case by case today: no self-service portal.
Inputs for your record of processing
The console does not present a record of processing (GDPR Art. 30) and we will not pretend otherwise. It does supply part of the material: the providers tab shows the published training and retention policy. Data categories, purposes and sub-processors are described on this page.
Your obligations depend on your sector
Law 25 applies to every enterprise carrying on business in Quebec. Depending on your field it stacks on top of a professional order, a financial regulator or a health regime that adds its own — sometimes stricter — requirements. Pick your situation: each page cites the texts, quotes them, and says what we answer.
Financial services
Institutions regulated by the Autorité des marchés financiers, registered dealers and advisers, portfolio managers. Incident clocks that start at 24 hours and keep running every 3 days, seven years of retention, a rule requiring records to stay in Canada if you are federally chartered, and a regulator that has to be able to inspect you through your vendor.
AMF · CIRO · CSA · OSFI
Insurance and distribution
Firms, representatives, brokers and claims adjusters. This is one of the few Canadian sectors where the law genuinely requires that client records be kept in Quebec.
Distribution Act · Chambre de l'assurance · AMF
Law and notarial practice
Professional secrecy is a quasi-constitutional right of the client, not a contractual obligation. And the Barreau takes the view that entering privileged information into an open system is already a breach.
Barreau · Chambre des notaires · Courts
Health and social services
The most heavily regulated sector, and the one where our answer includes a clear “no”: the clinical record requires a product certified by Santé Québec.
Law 5 · Santé Québec · fifteen orders
Accounting and tax
The Ordre's AI guide sets a simple and demanding test: never enter confidential information into a tool that does not guarantee confidentiality. Which still leaves you having to verify the guarantee.
CPA Québec · Professional Code
Public sector
Departments, public bodies, municipalities, school service centres, CEGEPs and universities. Since December 2025, digital sovereignty is a written policy direction — but it does not cover everyone, and that is the first thing to check.
Access Act · CAI · MCN · Public Contracts Act · BAnQ
Professional orders
Engineers, human resources advisors, psychoeducators, guidance counsellors, translators and the rest. One common foundation, then 46 different regulations.
Professional Code · CIQ · the orders
Any business
Law 25 applies the moment you carry on an enterprise in Quebec and hold information about individuals — clients, employees, applicants. With no professional order and no sector regulator, this is your baseline.
Law 25 · CAI · PIPEDA
Looking to understand Law 25 first?
We wrote the summary we wish we had found: what the statute requires, section by section, with the official text linked at every point, the real penalties, and what adopting AI triggers inside all of it.
The questions people actually ask us
- Is my data used to train artificial intelligence?
- No. The master agreement forbids using your confidential information to train a public model without your written authorization, and the default configuration uses providers whose terms do not permit it. The admin console shows each provider's published policy, so you can verify rather than believe us. Two reserves. What we do not have: a technical control that would refuse the call, point of execution by point of execution — the commitment is contractual, not enforced by the machine, and that is on our roadmap, with no date. And at one of the named providers, the API's unpaid tier permits training and human review; only the paid tier carries the commitment. Ask us in writing which tier your instance is on.
- Does my data stay in my country?
- What the platform stores, yes: your instance is hosted in Canada and backups replicate to a second Canadian region. The content of a request sent to a model, no: it goes to the selected provider, several of which operate in the United States, for as long as it takes to produce the answer. We would rather say so plainly than let you assume otherwise.
- Do I have to redact documents before using them with AI?
- No, not as a rule. Law 25 does not require redaction before entrusting information to a service provider: it requires a written agreement, an assessment where processing happens outside Quebec, and measures proportionate to sensitivity. It also requires, upstream, a privacy impact assessment — acquiring a system that processes personal information triggers one on its own (s. 3.3). Two traps. Information that is merely de-identified remains personal information; only anonymization, in the strict sense of the regulation, takes it out of scope. And if you belong to a professional order, professional secrecy demands its own analysis, often stricter. Your sector's page covers both.
- What happens if a foreign authority demands my data?
- What we store is in Canada, with a host subject to Canadian law, and the contract provides for Quebec law and the jurisdiction of the Montreal courts. The contract obliges us, where the law permits, to notify you in advance of any legally compelled disclosure and to limit it to what is required. We do not claim a US provider would be beyond the reach of a US procedure: we tell you what content reaches it, for how long, and how to reduce that surface.
- How long does the model provider keep my question?
- It depends on the provider, which is exactly why the product displays it rather than summarizing it. Some keep nothing. Others keep a few weeks for abuse detection. A few publish no duration at all — in that case the console says "unknown", never "no retention". An administrator who requires zero retention can restrict the catalogue accordingly.
- Can I limit which models my team uses?
- Yes, and it is the most concrete governance lever there is. Access is set by group and by named user — and globally, or for administrators only. The refusal happens at call time, not just in the picker, so a workaround interface does not get around the rule, and the switch binds administrators too. The reserve, and it holds everywhere we talk about this switch: it binds the models a USER picks, not the calls the SERVER makes on its own. Several of those carry real content — extracting the text of a document added to a knowledge base or pulled from a connector, the Law 25 detector, the conversation title, the agent's screenshot, AI-assisted email. The list is not exhaustive. In other words: restricting the catalogue is not enough to guarantee that an excluded provider will never see confidential content. That is the most important gap on this page; it is on our roadmap, with no date announced to date.
- Are you GDPR compliant?
- There is no GDPR certification, and we do not claim one. What we can say: the contract gives you the clauses of a processor within the meaning of Article 28, hosting is in Canada — a country the European Commission recognizes as adequate — and the console documents the sub-processors and their policies. What is missing, and we name it: no separate data processing agreement signable as it stands, no standard contractual clauses for transfers to the US providers, and no record of processing activities delivered. Those are three real gaps for a European controller, and they are on our roadmap.
- How does a European user exercise their right of access, rectification or erasure?
- By writing to your administrator, who locates and handles the request using the per-object access lists and the audit log. It is not yet a self-service portal, and we do not have a committed internal deadline in the contract for these requests — tell us early if a specific deadline applies to you.
Have us checked rather than believed
Send us your security questionnaire, your professional order's grid, or your lawyer's questions. We answer point by point, including when the answer is "not yet".
Security question or vulnerability report: support@hilointelligence.ca.