Trust
Trust, documented.
The frameworks we operate against. The sub-processors that touch your data. The response times we commit to in writing. For the technical posture of redactlabs.ca itself, see Security Posture.
Compliance, by source
What governs the work.
We operate against published standards and map every engagement back to them. Where regulated clients need board-ready evidence, the mapping is the evidence.
| Framework | What it is | Scope |
|---|---|---|
| NIST CSF 2.0 | Govern, Identify, Protect, Detect, Respond, Recover. Released February 2024 — the first major revision in a decade. Our default control taxonomy. | Every engagement |
| CIS Controls v8 | 18 control categories across three Implementation Groups. IG2 for charities and growing SMBs; IG3 for regulated and high-revenue clients. | Technical depth |
| CyberSecure Canada | Federal SMB certification on the CAN/CIOSC 104:2021 baseline. 13 baseline controls, mapped on every engagement. | Minimum bar |
| PIPEDA | Federal private-sector privacy law. Privacy-impact assessments, OPC-aligned breach response, board-ready documentation. | All commercial CA clients |
| Quebec Law 25 | Modernized Quebec private-sector privacy. Privacy officers, mandatory PIAs, breach notification, GDPR-style consent. Penalties up to C$25M or 4% of turnover. | Clients operating in Quebec |
| PHIPA | Ontario’s Personal Health Information Protection Act. Consent, breach-notification, and record-keeping for health-information custodians. | Ontario health clients |
Sub-processors
Every vendor, named.
The infrastructure that delivers RedactLabs services, listed up front so procurement does not have to ask.
| Sub-processor | Purpose | Data region |
|---|---|---|
| Cloudflare | Edge network, DNS, WAF, Workers, Turnstile bot checks, Workers KV, Queues, R2 object storage, Workers Logs, and Analytics Engine | Global edge; R2 in Eastern North America; KV replicated globally |
| Resend | Transactional email delivery and the mailing-list audience | United States |
| Sentry | Error monitoring for the site’s Workers — headers, cookies, query strings, and IP addresses are stripped before an event is sent | United States or EU (Sentry account region) |
| Microsoft 365 | Internal email, collaboration, document storage | Canada (data residency) |
| Proton Business Suite | Encrypted email, secure file storage, calendar, VPN | Switzerland / EU |
| Proton Pass Business | Credential vaulting and shared secrets | Switzerland / EU |
| GitHub | Source control for Worker templates and tooling | United States |
Engagement-specific tools — EDR, SIEM, identity, backup — are scoped per engagement and named in your statement of work. We never recommend a vendor whose referral fee we have not disclosed to you in writing.
Response times, committed
Acknowledgement, in writing.
Acknowledgement targets, not resolution targets. Resolution depends on scope.
| Engagement | Acknowledge | Hours |
|---|---|---|
| Plans with Managed Security — security incident | 1 business hour | Mon–Fri, 9:00–17:00 ET |
| Managed IT plans — urgent IT issue | 1 business hour | Mon–Fri, 9:00–17:00 ET |
| Managed IT plans — standard IT request | 4 business hours | Mon–Fri, 9:00–17:00 ET |
| Managed plans — outside business hours | Best effort | No 24/7 response |
| Security vulnerability reports | 72 hours | See Security Posture |
| Sales / scoping enquiries | 1 business day | Mon–Fri, 9:00–17:00 ET |
Data retention
Held briefly. Purged on schedule.
What we hold, where it lives, and how long it stays.
- Contact-form enquiries
- Not written to the site’s own storage. The message is relayed by email — Cloudflare Queue, then Resend — to the RedactLabs inbox; the site’s audit log keeps only the event type, the outcome, and a truncated IP. Enquiry emails are kept for 2 years after last contact.
- Audit and security logs
- PII-redacted audit events plus CSP and network-error reports, in Cloudflare R2 (Eastern North America). IPs appear only as truncated ranges (/24 IPv4, /48 IPv6), never full addresses. 30-day retention, then purged.
- Request and delivery logs
- Cloudflare Workers Logs record each request — including the full IP address, user agent, and referrer — and email-delivery lines that include the recipient address. Kept by Cloudflare for at most 7 days, for debugging and abuse investigation.
- Rate limits and pending requests
- Workers KV counters keyed by IP or email address expire on their own within 60 seconds to 24 hours. Unconfirmed report, newsletter, and waitlist requests expire after 24 hours; a scan-report link and its data after 7 days; resource download links after 72 hours.
- Mailing list and newsletter
- Email address only, held in Resend. One-click unsubscribe in every send. Confirmation markers (the address itself) stay in Workers KV for one year, a marker that stops duplicate scan-report emails to the same address for 90 days, and resource-delivery records — keyed by a hash of the address — for one year. Never sold, never shared.
- Client engagement data
- CA-region Microsoft 365 with conditional access. Retained for the engagement plus 7 years for tax and audit, then purged.
Audit pack
The full pack, under NDA.
DPA, MSA template, sub-processor list, insurance certificates, and a SOC-style control summary. Available under NDA to active and prospective enterprise clients.