# Trust, documented — Compliance, Sub-Processors, SLAs | RedactLabs

> Source: https://redactlabs.ca/trust/
> Machine-readable Markdown of this page (also served at this URL under `Accept: text/markdown`).

# Trust, documented.

The frameworks we operate against. The sub-processors that touch your data. The response times we commit to in writing. For the technical posture of redactlabs.ca itself, see [Security Posture](/security/).

- **NIST CSF 2.0** — default control taxonomy.
- **CIS Controls v8** — technical implementation depth.
- **CyberSecure Canada** — baseline on every engagement.
- **PIPEDA · Law 25 · PHIPA** — for in-scope Canadian clients.

## What governs the work.

We operate against published standards and map every engagement back to them. Where regulated clients need board-ready evidence, the mapping is the evidence.

*Compliance frameworks, by source*

| Framework | What it is | Scope |
| --- | --- | --- |
| NIST CSF 2.0 | Govern, Identify, Protect, Detect, Respond, Recover. Released February 2024 — the first major revision in a decade. Our default control taxonomy. | Every engagement |
| CIS Controls v8 | 18 control categories across three Implementation Groups. IG2 for charities and growing SMBs; IG3 for regulated and high-revenue clients. | Technical depth |
| CyberSecure Canada | Federal SMB certification on the CAN/CIOSC 104:2021 baseline. 13 baseline controls, mapped on every engagement. | Minimum bar |
| PIPEDA | Federal private-sector privacy law. Privacy-impact assessments, OPC-aligned breach response, board-ready documentation. | All commercial CA clients |
| Quebec Law 25 | Modernized Quebec private-sector privacy. Privacy officers, mandatory PIAs, breach notification, GDPR-style consent. Penalties up to C$25M or 4% of turnover. | Clients operating in Quebec |
| PHIPA | Ontario’s Personal Health Information Protection Act. Consent, breach-notification, and record-keeping for health-information custodians. | Ontario health clients |

## Every vendor, named.

The infrastructure that delivers RedactLabs services, listed up front so procurement does not have to ask.

*Sub-processors that touch client data*

| Sub-processor | Purpose | Data region |
| --- | --- | --- |
| Cloudflare | Edge network, DNS, WAF, Workers, Turnstile bot checks, Workers KV, Queues, R2 object storage, Workers Logs, and Analytics Engine | Global edge; R2 in Eastern North America; KV replicated globally |
| Resend | Transactional email delivery and the mailing-list audience | United States |
| Sentry | Error monitoring for the site’s Workers — headers, cookies, query strings, and IP addresses are stripped before an event is sent | United States or EU (Sentry account region) |
| Microsoft 365 | Internal email, collaboration, document storage | Canada (data residency) |
| Proton Business Suite | Encrypted email, secure file storage, calendar, VPN | Switzerland / EU |
| Proton Pass Business | Credential vaulting and shared secrets | Switzerland / EU |
| GitHub | Source control for Worker templates and tooling | United States |

Engagement-specific tools — EDR, SIEM, identity, backup — are scoped per engagement and named in your statement of work. We never recommend a vendor whose referral fee we have not disclosed to you in writing.

## Acknowledgement, in writing.

Acknowledgement targets, not resolution targets. Resolution depends on scope.

*Response-time commitments by engagement*

| Engagement | Acknowledge | Hours |
| --- | --- | --- |
| Plans with Managed Security — security incident | 1 business hour | Mon–Fri, 9:00–17:00 ET |
| Managed IT plans — urgent IT issue | 1 business hour | Mon–Fri, 9:00–17:00 ET |
| Managed IT plans — standard IT request | 4 business hours | Mon–Fri, 9:00–17:00 ET |
| Managed plans — outside business hours | Best effort | No 24/7 response |
| Security vulnerability reports | 72 hours | See Security Posture |
| Sales / scoping enquiries | 1 business day | Mon–Fri, 9:00–17:00 ET |

## Held briefly. Purged on schedule.

What we hold, where it lives, and how long it stays.

- **Contact-form enquiries**: Not written to the site’s own storage. The message is relayed by email — Cloudflare Queue, then Resend — to the RedactLabs inbox; the site’s audit log keeps only the event type, the outcome, and a truncated IP. Enquiry emails are kept for 2 years after last contact.
- **Audit and security logs**: PII-redacted audit events plus CSP and network-error reports, in Cloudflare R2 (Eastern North America). IPs appear only as truncated ranges (/24 IPv4, /48 IPv6), never full addresses. 30-day retention, then purged.
- **Request and delivery logs**: Cloudflare Workers Logs record each request — including the full IP address, user agent, and referrer — and email-delivery lines that include the recipient address. Kept by Cloudflare for at most 7 days, for debugging and abuse investigation.
- **Rate limits and pending requests**: Workers KV counters keyed by IP or email address expire on their own within 60 seconds to 24 hours. Unconfirmed report, newsletter, and waitlist requests expire after 24 hours; a scan-report link and its data after 7 days; resource download links after 72 hours.
- **Mailing list and newsletter**: Email address only, held in Resend. One-click unsubscribe in every send. Confirmation markers (the address itself) stay in Workers KV for one year, a marker that stops duplicate scan-report emails to the same address for 90 days, and resource-delivery records — keyed by a hash of the address — for one year. Never sold, never shared.
- **Client engagement data**: CA-region Microsoft 365 with conditional access. Retained for the engagement plus 7 years for tax and audit, then purged.

## The full pack, under NDA.

DPA, MSA template, sub-processor list, insurance certificates, and a SOC-style control summary. Available under NDA to active and prospective enterprise clients.