Security and trust
Built to be reviewed, not just described
SquareSync holds owners' personal information, board approval records and corporation mailboxes. This page sets out the controls that are in place, and is written to be handed to your auditor or counsel.
Canadian data residency
Application data hosted in a Canadian region; corporation mailboxes in a Microsoft 365 tenant with Canadian data location.
Encryption
TLS in transit; encryption at rest for database, object storage and backups. Secrets in a managed vault, never in source control.
Tenant isolation
Every record scoped to its corporation, resolved from the hostname and re-checked in the authorisation layer, with automated tests proving corporation A cannot reach corporation B.
Access control
Ten roles with capability-level permissions scoped to a unit, corporation, portfolio or platform. MFA required for privileged roles.
Audit logging
Authentication, authorisation changes, approvals, grants, exports and mail configuration in an append-only log.
Backups and recovery
Encrypted off-site backups with restore testing on a published schedule and a documented DR runbook.
Independent testing
A grey-box penetration test by an independent Canadian firm covers tenant isolation, authentication, authorisation, file handling, the mail integration and exposed infrastructure. Critical and high findings are remediated and retested, and an attestation letter is available under NDA.
Internally, authorisation and tenant-isolation test suites run on every pull request alongside dependency and secret scanning.
Straight answers
- We describe the controls we have implemented, and nothing else. We do not hold a SOC 2 or ISO 27001 certification and we do not imply that we do.
- We do not claim the platform makes a corporation legally compliant. It supports documented processes and record-keeping.
- We do not publish uptime figures we have not measured.
Privacy
Accountability
A named privacy officer is responsible for our privacy programme under PIPEDA, including the data inventory, retention schedule and breach-response procedure.
Roles are separate
The corporation is accountable for owner information, the management company processes it on the corporation's behalf, and SquareSync is the service provider.
Retention and deletion
Records kept to a published retention schedule reflecting condominium record-keeping obligations, and deleted on request with a certificate.
Responsible disclosure
If you believe you have found a security issue, email security@squaresync.ca. We will acknowledge within two business days, keep you updated, and will not pursue action against good-faith research that respects customer data and avoids service disruption.
Bring your security questions to the demo
We would rather answer your auditor's questions before you sign than after.