Security and hosting
Where your data lives, and who can touch it
The only real question people ask a new software publisher is "what if you shut down?". Here is what is in place, fact by fact, as verified in the code and the operations documentation on September 8, 2026.
The legal side — your obligations, subcontractors, your rights — is on Law 25 and in the Privacy Policy.
Your data lives in Montréal
Application, programming interface, database and files: everything is hosted in Canada, in the same region, at Amazon Web Services.
Canada (Central) region — Montréal, ca-central-1 — for the instance, the database and the storage.
No data is hosted outside Canada. What is transmitted to foreign subcontractors is listed below, and in the Privacy Policy.
Managed database, encrypted, never exposed to the Internet.
It only accepts connections from the application; the instance disks are encrypted too.
Files (photos, PDFs, documents) in encrypted object storage, public access blocked, isolated per company.
Each company has its own prefix; the application gets its rights through a machine role, without a static access key.
Everything travels encrypted (HTTPS), with certificates renewed automatically.
The browser also receives strict instructions that block interception, script injection and clickjacking.
What leaves Québec: five flows, limited and framed.
Payments (Stripe, USA), transactional emails (Resend, USA), AI generation (Anthropic, USA — the brief is anonymized before sending, no personal data), address geocoding (Geoapify, European Union) and technical error reports (Sentry, USA — tokens, identity headers, request bodies, SINs and emails are removed before sending). The detail and the legal basis (s. 17 of Law 25, privacy impact assessment) are in the Privacy Policy, section 5.
Losing one day, never more
Two levels of copies, one of them off the machine, every night — and an alert if it does not leave.
Automatic database backups by the platform, kept for 7 days.
Point-in-time restore within that window.
Every night, a complete encrypted copy is deposited off the machine, in separate storage in Montréal.
Rights are write-only: a compromised machine cannot erase the copies. Retention: 7 days for daily copies, 35 days for weekly, 366 days for monthly.
The night backup is monitored: if it doesn't run, an alert goes out.
A scheduled-task monitor waits for the signal every night, with two hours of tolerance.
Someone is warned before you are
Probes from the outside, errors captured from the inside: an incident is seen before a client writes about it.
Three external probes check the service every five minutes, since August 9, 2026.
They don't depend on our servers: if BatiCore stops responding, the founder is alerted.
Application errors are captured and grouped, server-side and browser-side, without personal data.
An incident is seen before a client writes about it; reports are scrubbed before leaving our servers.
Who can see what
Roles verified by the server, a second factor, short sessions — and audited isolation per company.
Seven roles, and every permission is verified by the server — not just hidden on screen.
Owner, administrator, sales manager, finance, estimator, site supervisor, worker: a worker only sees their job site and their clock-in.
Two-factor authentication (authenticator app) with backup codes; Google or Microsoft sign-in possible, with the second factor enforced.
The second factor is each user's choice; it becomes mandatory as soon as you sign in through an identity provider.
Passwords never stored in clear (transformed irreversibly); sign-in limited to ten attempts per minute.
Brute force is slowed by the server, not by the browser.
Short sessions: a 15-minute access token renewed silently, a 7-day session (30 with "Remember me").
Tokens live in cookies inaccessible to scripts; "Sign out other devices" revokes sessions in one gesture.
Isolation per company: every request is tied to your company, and two internal audits verified it.
Security and Law 25 audit in July 2026 (no leak between companies found); second audit in August 2026, with hardening delivered right after: stronger two-factor chain, token renewal, protection against forged requests, shared rate limiting.
API keys (Enterprise plan) with their own permissions, every action logged with the key identifier.
A key cannot create another one, and the owner cannot use one as a shortcut.
A register that cannot be rewritten
The audit log and the signatures carry a fingerprint: altering the past shows.
Every sensitive action is recorded with its author, its date and its company — and every entry carries the digital fingerprint of the previous one.
Modifying, deleting or reordering a line breaks the chain, and the verification detects it.
Estimate signatures are legally valid in Québec (LCCJTI): digital fingerprint of the document, timestamp, IP address and explicit consent recorded.
The client signs from a private link, without creating an account; the signed PDF and its fingerprint are kept.
Encrypted in transit, at rest — and, for the most sensitive, inside the application
Three layers: in transit, on the disks, and inside the application for the most sensitive.
In transit: everything is encrypted, everywhere. On the disks: database and files encrypted by the platform.
A disk or a database copy taken out of its context is unreadable.
Inside the application, with strong encryption: the social insurance numbers of employees and subcontractors, and the second-factor secrets.
Encrypted with a key the database does not know; a keyring allows rotating that key without interruption.
Your data stays yours
Export, erasure, designated officer — self-serve, and with no time limit when you leave.
Export of a client's or an employee's information, and anonymization on request (right to erasure), from the application.
Anonymization erases personal information and keeps the records subject to legal retention; every anonymization is recorded in a register, as is every confidentiality breach.
A person in charge of the protection of personal information can be designated by written delegation; otherwise, the function falls to the owner.
That's section 3.1 of Law 25, tooled rather than left to goodwill.
At the end of the subscription, the account becomes read-only: your data stays viewable and exportable, with no time limit.
CSV and Acomba exports of invoices, payments and journals; per-person export for Law 25.
Frequently asked questions
Where is BatiCore's data hosted?
In Montréal, at Amazon Web Services (Canada Central region, ca-central-1): the application, the database and the files, in the same region, encrypted at rest. Only five limited flows leave Québec — payments, emails, anonymized AI generation, address geocoding and error reports without personal data — and they are listed in the Privacy Policy.
Who at BatiCore can see my data?
Solutions BatiCore Inc. acts as an agent: your data is only processed to provide you the service, never sold or used on its own account. Support access only happens at your request or for an incident. Within your company, your seven roles decide who sees what, and the server verifies every permission.
What happens if a server goes down or data is lost?
The database is backed up automatically for 7 days, and a complete encrypted copy is deposited every night off the machine, write-only, kept for up to a year. Three external probes check the service every five minutes.
Can I get my data back if I leave BatiCore?
Yes. Invoices, payments and journals export as CSV and in Acomba format; a client's or an employee's information exports one by one for Law 25. Without a subscription, the account becomes read-only and stays viewable and exportable with no time limit.
Found a vulnerability?
Write to support@baticore.ca. A human answers within one business day; a confirmed vulnerability is fixed as a priority and you are kept informed. The channel is also published in security.txt.
Last fact-by-fact check: September 8, 2026. A claim that stops being true is withdrawn the same day.