Professional secrecy has no “service provider” exception

Le professionnel doit respecter le secret de tout renseignement de nature confidentielle qui vient à sa connaissance dans l'exercice de sa profession. Il ne peut être relevé du secret professionnel qu'avec l'autorisation de son client ou lorsque la loi l'ordonne ou l'autorise par une disposition expresse.

What it means

The list of ways out is closed: the client's authorization, an express provision of law, or preventing a serious risk of death or serious bodily injury. There is no “service provider” exception equivalent to s. 18.3 of Law 25. That is why a firm's analysis is never the analysis of an ordinary business.

What we answer

We do not claim that a contract is enough to satisfy professional secrecy — that would be false. What we can demonstrate is that the platform acts solely on your behalf: no use of its own, no training on your content without written authorization, staff access limited to a need-to-know basis, and an audit right so that you can verify it.

hard law·Version in force since 1 July 2024; text read as up to date to 1 April 2026·Official source

L'avocat assure la confidentialité de tous les renseignements relatifs aux affaires et activités d'un client qui sont portés à sa connaissance à l'occasion de la relation professionnelle.

What it means

The perimeter is broader than privilege: everything the lawyer learns about the client's affairs and activities is covered. But s. 65 is the wrong frame for a supplier — it lists exhaustively the cases of DISCLOSURE, and its paragraph 1 in fact accepts the client's “express or implied” authorization. Entrusting data to a service provider falls under s. 61, which governs the people cooperating with the lawyer through an obligation of means.

What we answer

The contract covers the client's “confidential information”, not only personal information — the distinction matters here. Confidentiality survives the end of the contract by five years, with no time limit for trade secrets and for as long as the law protects personal information. One reserve that section 60 makes it necessary to name, because its reach is longer than ours: your professional secret does not expire. Business information that is neither a trade secret nor personal information is covered by our clause for five years after the contract ends — beyond that the obligation running is yours, not ours, and that is one more reason to export and close a file rather than let it live here.

hard law·O.C. 129-2015; version read as up to date to 1 April 2026·Official source

L'avocat prend les moyens raisonnables pour assurer la protection des renseignements confidentiels par toute personne qui coopère avec lui dans l'exercice de ses activités professionnelles, de même que, le cas échéant, par le cabinet au sein duquel il exerce de telles activités. De même, lorsqu'il exerce ses activités professionnelles au sein d'une organisation, l'avocat prend les moyens raisonnables pour que celle-ci mette à sa disposition les moyens nécessaires pour lui permettre d'assurer la protection des renseignements confidentiels.

What it means

An obligation of means, not of result, and it runs in two directions: the people who cooperate with you, and the organization that must give you the means to protect. The text of the section says nothing about geography; your order does say something about it, and that is what sets the measure of the “reasonable”. Its IT Guide asks you to favour “clouds made up of servers located solely on Canadian soil and under the control of Canadian entities” and calls hosting abroad “very risky from an ethical standpoint”. The test therefore has two halves — the soil AND the control — and a Canadian hosting region satisfies only one of them. The Barreau notes that this guide is being updated, which does not withdraw it from circulation.

What we answer

Saying the section is “geographically neutral” and leaving it at that would be misleading: that is true of the text, false of the regulator, and half of its test is missing on our side. The servers are indeed on Canadian soil — Azure Canada Central (Toronto) by default, and, if an obligation requires Quebec, through private hosting — the shared cloud, for its part, offers only one Canadian region today — but the host is not a Canadian entity, and neither are the model suppliers: several operate in the United States, which is exactly the hosting abroad the guide judges very risky. On what the section actually demands — means — the inputs for your demonstration are on this page: named regions, the route of a request described step by step, each supplier's retention policies, encryption in transit and at rest, access by user and by group, an audit log, and section 14 of the contract. The guide is a recommendation, not a regulation — but a disciplinary committee can draw on it, and you are better off having read it before it does.

hard law·O.C. 129-2015; version read as up to date to 1 April 2026·Official source

Pour l'application du premier alinéa, font partie des connaissances et des habiletés que l'avocat développe et tient à jour celles relatives aux technologies de l'information qu'il utilise dans le cadre de ses activités professionnelles.

What it means

Command of the technologies you use is part of the duty of competence — and the paragraph that says so does not date from the 2015 Code: the Barreau added it in 2020, which says enough about what it thinks. A lawyer who does not know where their tool's data goes is in breach of s. 21 before any incident even occurs.

What we answer

That is exactly why this page is written the way it is: so that a lawyer can understand the mechanism, not merely receive an assurance. The three states of data, the path of a request and the distinction between what stays in Canada and what does not are there to be understood and cited.

hard law·O.C. 129-2015, s. 21; paragraph 2 added by O.C. 1102-2020, s. 4; text read as up to date to 1 April 2026·Official source

Le simple fait d'entrer des informations protégées par le secret professionnel dans un tel système ouvert (c'est-à-dire un système accessible au public et dont les données ne sont pas stockées en interne) constitue une violation, même sans reproduction ou divulgation effectives

What it means

The breach is complete upon input, with no leak. The guide adds that “closed-circuit systems, developed and deployed within an organization and keeping data in-house, reduce those risks” — and you have to read the middle clause, not just the words “closed circuit”: the guide describes a system developed and deployed WITHIN the organization, which makes its application to a dedicated cloud instance arguable rather than settled.

What we answer

An instance dedicated to your firm, with its own database in Canada, is not a publicly accessible system. We will not claim for all that that it ticks the guide's definition: that definition speaks of a system deployed within the organization, and the request leaves the instance to be computed. That is the exact point you have to assess, and the console gives you each supplier's retention policy so that you can.

regulator expectation·2nd edition, PDF ISBN 978-2-925336-43-3, legal deposit BAnQ/BAC 2025; PDF revised in 2026·Official source

Avant d'utiliser des données avec l'IA, anonymisez-les pour éviter toute identification directe ou indirecte d'une personne. […] Limitez la quantité d'informations utilisée à ce qui est strictement nécessaire pour que l'outil d'IA accomplisse sa tâche.

What it means

This is the most categorical instruction in the Barreau's body of material, and it comes before any discussion of hosting or contracts: anonymize first, minimize second, and give up the tool if you cannot anonymize. It addresses the daily gesture, not the architecture.

What we answer

It has to be read alongside our section on redaction, and the two do not say the same thing. Law 25 does not require you to redact before entrusting data to a service provider; your order does ask you to anonymize before putting anything into an AI tool. When the two regimes diverge, the stricter one governs, and for a lawyer that is this one.

regulator expectation·2nd edition, legal deposit BAnQ/BAC 2025; PDF revised in 2026·Official source

Dans tous les cas, il est important d'informer les clients des risques liés au modèle d'infonuagique sélectionné et d'obtenir leur accord lorsque ce modèle ne permet pas de garantir la protection des informations confidentielles […] dès que les données des clients sont hébergées ailleurs qu'au bureau ou sont répliquées à l'externe, il est préférable d'en aviser le client.

What it means

The guide sets two thresholds, and they have to be told apart. The first is low and is triggered by the mere fact of hosting: as soon as the client's data leaves the office or is replicated externally, you notify the client. The second is heavier and is triggered by an insufficiency: where the cloud model chosen does not make it possible to guarantee the protection of confidential information, informing is no longer enough — you have to obtain the client's agreement. The trigger is therefore not the occurrence of an incident, it is the choice of model itself.

What we answer

With us, hosting is by construction “somewhere other than the office”: an instance dedicated to your firm on Azure Canada Central (Toronto) by default, a Quebec region only under private hosting, encryption in transit and at rest, access by user and by group, an audit log. The guide's low threshold is therefore crossed with the very first file you put in, with no possible exception. So is the high one, and this is where it pays to be clear rather than reassuring: the model computation leaves your instance and runs at foreign suppliers, several of them in the United States. On that segment we do not guarantee protection; section 14 of the contract frames what depends on us — confidentiality, purposes, sub-processors, incidents, an annual audit right, advance notice before any legally compelled disclosure — but a contractual undertaking is not the guarantee the guide is talking about. Informing your client and obtaining their agreement is therefore a step you have to take and that we cannot take in your place; what we supply is the substance of that conversation: the route of a request, the hosting regions, the sub-processors and their countries, each supplier's retention policies.

regulator expectation·Last updated January 2016; as of 11 August 2026, the Barreau displays on the guide the notice “Veuillez noter que ce guide fait actuellement l'objet d'une mise à jour” (please note that this guide is currently being updated)·Official source

L'avocat donne suite, au plus tard dans les 30 jours de sa réception, à toute demande faite par un client: 1° de faire corriger, dans un dossier qui le concerne, des renseignements inexacts, incomplets ou équivoques eu égard aux fins pour lesquelles ils ont été recueillis

What it means

Thirty days to correct, and paragraph 2 goes further: deleting a specific piece of information inside a record. That is not the same thing as “nothing is deleted automatically” — it is a targeted deletion capability, on request, within a deadline.

What we answer

A message can be corrected in place and the change leaves an entry in the audit log; conversations, documents and attachments can be deleted. What the platform does not have: a workflow tying a correction request to the correction and keeping proof of it. Over thirty days that is manageable by hand, but the compliance trail is yours to build.

hard law·O.C. 129-2015, s. 55; text read as up to date to 1 April 2026·Official source

Lorsque le dossier d'un client n'est plus actif, il doit le conserver au moins 7 ans à compter de la date de sa fermeture. Il peut utiliser alors tout système ou procédé d'archivage qui lui donne accès à l'information que contient le dossier à la date de sa fermeture.

What it means

Seven years after closing, with access to the information as it stood on that date; paragraph 1 adds a rule about place — active records are kept at the lawyer's professional domicile or in an appropriate place — and paragraph 2 defines “active record” narrowly. The guide on generative AI states that the prompts, the data and the outputs produced by AI form part of the record and follow that same period. Beware a common misattribution here: access for the syndic does not come from s. 29 of this regulation, which opens the division on administration and trust accounting and covers only that accounting. It comes from s. 192 of the Professional Code — the syndic and the professional inspection committee may examine any record kept by a professional and require a copy of it, and the professional may not invoke professional secrecy to refuse — and s. 114 makes refusal or obstruction a separate offence. The rule is therefore stronger than that misattribution suggests, not weaker.

What we answer

No purge you can configure breaks the seven-year period, and the record exports in full — but three automatic deletions apply all the same, and one of them can carry off a piece of the record. Three timers are hard-coded and reach a record directly, and they cannot be turned off: transcripts at 30 days, tool-produced files at 7 days, attachments never sent at 48 hours — see s. 19 for what that implies when the item concerned is the only copy of a client's original. As for s. 192, what a tool has to allow is simply stated and we hold it: no content is inaccessible to the lawyer of record, the export is complete, the audit log traces accesses and changes, and editing a message leaves an entry in it. What we do not have: configurable retention that would carry the seven years, and a certificate of destruction at expiry. The master copy of the record therefore has its place in your archiving system; the platform is where the work happens, not where the regulatory period is purged. Those are the timers that reach a record; other clocks exist elsewhere in the product, and the Confidentiality and compliance page publishes the full inventory.

hard law·Decision 2010-02-17, in force 1 September 2012; version read as up to date to 1 April 2026·Official source

L'avocat ne peut détruire un original qui appartient à un client sans avoir obtenu l'autorisation de celui-ci ou sans lui avoir donné la possibilité de le reprendre.

What it means

This is the destruction rule, and it is disjunctive: the client's authorization, or the opportunity offered to take the original back. Either one suffices, but neither is presumed — each supposes a step taken by the lawyer towards the client. The text covers only originals belonging to the client, not working copies, and it sets no deadline after which destruction would become free.

What we answer

This is the rule that bounds our timers, and three of them, hard-coded and not disableable, reach a record directly: transcripts deleted at 30 days, tool-produced files at 7 days, attachments never sent at 48 hours. As long as the item concerned is a working copy, their firing touches no client original. The moment it is the only copy of one — the recording of a meeting nobody filed anywhere else, the exhibit a client dropped into a message that stayed unsent — the timer destroys an original without your having obtained authorization or offered its return, and s. 19 is in default without anyone having decided it. Retention is not configurable: these periods cannot be lengthened and cannot be turned off, and we do not issue a certificate of destruction, so proof of what was destroyed and when will not come from us either. The only safeguard is procedural: export out of the platform before the deadline, and never let an original live there alone. Those are the timers that reach a record; other clocks exist elsewhere in the product, and the Confidentiality and compliance page publishes the full inventory.

hard law·Decision 2010-02-17, s. 19; in force 1 September 2012; text read as up to date to 1 April 2026·Official source

Le notaire doit conserver le secret absolu des confidences qu'il reçoit en raison de sa profession.

What it means

The word “absolute” is peculiar to notarial practice and it is not decorative: the obligation yields only if the notary is released from it, expressly or by implication, by the person who confided in them, or in the cases provided for by law. The Chambre puts this section at the top of its own table of obligations.

What we answer

No supplier can release you from it, and we do not claim to. What the contract does: prohibit any use of your content for our own purposes, limit our staff's access to a need-to-know basis, and give you an audit right. The decision to entrust a confidence to a tool remains yours, and it is taken under this section.

hard law·2001, c. 78, s. 16; am. 2017, c. 10 and 2023, c. 5; text read as up to date to 1 April 2026·Official source

Le notaire qui utilise le support informatique pour le traitement et la conservation de tout ou partie des éléments, renseignements et documents relatifs à un dossier doit: […] 3° protéger l'accès de ces données notamment par l'utilisation d'un mot de passe.

What it means

The same section requires a database separate from any other, the backing up of the data and a copy kept in accordance with s. 32. And s. 23 fixes the place: the office, or a place determined by the board of directors, or elsewhere — but then only with the written authorization of the secretary of the Chambre.

What we answer

The separate-database requirement is met by the architecture: each client gets a dedicated instance with its own database. But do not conclude from that that your compliance is settled. Keeping records with us means keeping them outside the office: you need the prior written authorization of the secretary of the Chambre, it is yours to obtain and no architecture replaces it. The Chambre also requires you to declare to it every technological solution used and any change to it.

hard law·Decision 2010-11-15; version read as up to date to 1 April 2026·Official source

Le notaire doit conserver dans son étude ou à tout autre endroit déterminé par le Conseil d'administration ses greffes, répertoire, index, […] ainsi que les dossiers visés au chapitre I, sauf autorisation écrite du secrétaire de la Chambre lui permettant de les conserver en tout ou en partie dans un autre endroit conformément à l'article 32.

What it means

This is a rule of place, and it is closed: the office, or a place determined by the board of directors. Any other place requires the written authorization of the secretary of the Chambre, obtained beforehand, and the section refers to s. 32 for the conditions of keeping in that other place. The rule covers the greffes, the repertory, the index and the records referred to in chapter I — client records, therefore, not only the acts.

What we answer

Let us say it without hedging: keeping your records with us means keeping them outside the office. Without the written authorization of the secretary of the Chambre, the notary who puts his records into the platform is in default from the very first document, and that depends on none of our technical characteristics — impeccable encryption does not turn an unauthorized place into an authorized one. That authorization is personal to the notary: we can neither request it for you, nor obtain it, nor stand in for it by contract, and we are not homologated by the Chambre des notaires. Note too that the authorization does not dispense with s. 32, to which s. 23 refers: it is added to it, and the vault requirement remains. What we can do comes after your decision, not before: a dedicated instance with its own database, hosting on Azure Canada Central (Toronto) by default or a Quebec region only under private hosting, encryption in transit and at rest, access by user and by group, an audit log, full export and section 14 of the contract.

hard law·Decision 2010-11-15, s. 23; text read as up to date to 1 April 2026·Official source

Le notaire conserve ses minutes, répertoire, index, livres de comptabilité en fidéicommis, logiciels d'application, […] les mises à jour ainsi que les copies de sauvegarde des données dans une chambre-forte ou un coffre-fort

What it means

This is the requirement the architecture does not settle. Backup copies of the data have to live in a vault or a fire-resistant safe, and s. 33 allows an inspector to require an expert's certificate attesting to that fire resistance. A data centre is not a safe within the meaning of this text.

What we answer

Our backups are in continuous archiving with our host, replicated to the paired region. That is not what s. 32 describes, and we are not going to pretend otherwise: for your minutes and your regulatory backup copies, the safe remains the safe. The platform is a working tool, not your vault.

hard law·Decision 2010-11-15; text read as up to date to 1 April 2026·Official source

Le greffe central numérique doit être hébergé au Québec. Le gouvernement peut toutefois, selon les modalités qu'il détermine, autoriser qu'il soit hébergé à l'extérieur du Québec.

What it means

One to watch: once in force, notarial minutes will go into a central digital repository administered by the Ordre, hosted in Québec unless the government authorizes otherwise, with an external security audit every five years communicated to the Minister of Justice. Sections 60, 64, 67 and 68 all carry the “not in force” note — we say so rather than announcing it as applicable law.

What we answer

This provision targets the repository of minutes, administered by the Ordre — not your day-to-day working tool. It nonetheless indicates the regulator's direction on data location, and it is a good reason to discuss right now private hosting — the only arrangement that offers a Quebec region — for hosting located closer to Québec rather than our default Canadian hosting.

hard law·Enacted by S.Q. 2023, c. 23, s. 46, replacing s. 68 of 2000, c. 44 — NOT IN FORCE according to the consolidated version up to date to 1 April 2026·Official source

La Cour s'attend à ce que les parties aux instances en informent la Cour et les autres parties si elles déposent des documents judiciaires créés en tout ou en partie au moyen de l'intelligence artificielle (IA).

What it means

All four courts require rigorous human verification and authoritative sources — court websites, recognized publishers, SOQUIJ, CanLII. The Federal Court is the only one to require a DECLARATION, in the first paragraph of the document. And the case law is already settled: citing non-existent decisions is an abuse of process.

What we answer

The platform cites its sources when it runs a search and keeps the full history of every conversation, which makes it possible to reconstruct after the fact what was produced with AI and to draft the required declaration. What we do not do: automatically flag a document as AI-generated, or verify that a cited decision exists. Verification remains entirely yours.

regulator expectation·2023–2024; in force·Official source

Les obligations qui incombent au fournisseur sont soit directes (le fournisseur doit maintenir la sécurité de l'information qu'il garde pour son client (i.e. le notaire)), soit indirectes (il doit permettre au notaire de respecter ses propres obligations envers son client, par exemple effectivement détruire l'information dont le notaire demande la destruction).

What it means

Of everything we have read in the Québec professional system, this is the only document addressed to the PROVIDER rather than to the professional — and that is why it counts here. It creates nothing: it lists obligations that already bind us as hard law, in particular ss. 25, 26, 27 and 34 of the Act to establish a legal framework for information technology, and it names the service provider as their direct debtor — “ensure the security, integrity and confidentiality of the technology-based documents entrusted to it and bar access to them by unauthorized persons”. Three clarifications on what the Chambre actually controls, up to date as of August 2026, because its page has changed since version 2.1 of the guide. Authorization from the CNQ is mandatory for THREE reserved services — closing a technology-based notarial act, keeping a technology-based notarial act, and using an official digital signature for a notary; videoconferencing for remote signing has been removed from that list and is now only the subject of selection criteria addressed to the notary, and the word “prior” no longer appears. For the rest, homologation is voluntary — except for identity-document verification solutions, which the Chambre does not homologate at all — and that voluntary process is currently SUSPENDED and under revision. On the notary's side, finally, the Chambre asks you to verify a NON-authorized solution before using it and to be able to produce proof of that verification on request, and to declare to the Ordre “only a technological solution whose data is kept by the application”; the Chambre ties that declaration to the Regulation respecting the keeping of records and offices of notaries, but that regulation, unchanged since 2010, mentions neither technological solutions, nor declaration, nor providers: the mechanism belongs to the Chambre's administrative policy, not to the regulation.

What we answer

We touch none of the reserved services: the platform does not close a notarial act, does not keep one and does not carry your official digital signature — any more than it provides the signing videoconference, which the Chambre has in fact removed from its authorization list. Authorization from the CNQ therefore does not apply. We are not homologated either: voluntary homologation presupposes a conformity review at the supplier's own cost, which we have not requested — and the process is in any case suspended and under revision at the Chambre, so unavailable today even if we wanted it. Two direct consequences for you, and we prefer to name them: we are a NON-authorized solution, so verification before use and proof of that verification fall to you; and our data is kept by the application, which makes us precisely the case the Chambre asks you to declare to the Ordre. What we can do is serve that verification: security measures, hosting regions, sub-processors and their countries, staff access on a need-to-know basis only, an audit log, an annual audit right in the contract. On the indirect side — enabling you to meet your own obligations — the example the Chambre gives is effective destruction on request, and that is a gap we name: deletion is possible and immediate, but we do not issue a certificate of destruction covering copies, backups and indexes.

regulator expectation·Created 16 August 2019, updated 26 September 2023 (version 2.1)·Official source

En ce qui concerne la relation notaire-client et les données de ce dernier, les dispositions des lois professionnelles ont préséance sur toutes dispositions de lois à portée générale […] le notaire ne peut pas communiquer à un tiers des informations relatives à son client, sans son autorisation écrite, sauf exception prévue par la loi.

What it means

The Chambre itself sorts the texts into two families: the professional statutes, which follow the notary wherever he practises, and the statutes of general application, among them the Act respecting the protection of personal information in the private sector. For the notary-client relationship, it says which one prevails: the professional one. The practical consequence is written in the same sentence — the client's written authorization is the door, subject to exceptions provided by law — and it is set out in a document devoted precisely to the notary-provider relationship.

What we answer

Our compliance story rests on Law 25: a written agreement, framed sub-processors, incident notification, an annual audit right — that is section 14 of the contract. The Chambre says that in notarial matters this is not sufficient, and it is right to say so: what we document is the general regime, whereas it is the professional regime that governs your relationship with your client. Concretely, putting a client record into an instance we operate hands information to a third party, and the question of the client's written authorization arises before the first document, not after the first incident. We can neither collect it in your place nor contract our way out of it, and we are not homologated by the Chambre des notaires. What remains on our side: a dedicated instance, hosting in Canada — Toronto by default, a Quebec region under private hosting only — encryption in transit and at rest, access by user and by group, an audit log, full export; and the gap we do not hide, the model computation at foreign suppliers, several of them in the United States.

regulator expectation·Version 2.1, created 16 August 2019, updated 26 September 2023; file linked as current by the Chambre as of 11 August 2026·Official source