Where your data lives, and who can touch it

A server in Beauharnois (Québec) for the application and the database; the files in the storage of the same data centre.

No data is hosted outside Québec, backups included. What is transmitted to foreign subcontractors is listed below, and in the Privacy Policy.

Database never exposed to the Internet.

It runs on the same server as the application and only accepts its connections; the server firewall only lets in encrypted Web traffic and key-based administration.

Files (photos, PDFs, documents) in encrypted, private object storage, isolated per company.

Each company has its own prefix; only the application server holds the access keys, and a file only opens through a signed, temporary link.

Files are checked: every file uploaded to BatiCore — by you, your team, a subcontractor or a client — is scanned by an antivirus before it is stored, and an infected file is refused.

The scan runs on our server, in Québec: the file goes to no third party.

Everything travels encrypted (HTTPS), with certificates renewed automatically.

The browser also receives strict instructions that block interception, script injection and clickjacking.

What leaves Québec: five flows, limited and framed.

Payments (Stripe, USA), transactional emails (Resend, USA), AI generation (Anthropic, USA — the brief is anonymized before sending, no personal data; only a supplier receipt photo goes as is, on your click), address geocoding (Geoapify, European Union) and technical error reports (Sentry, USA — tokens, identity headers, request bodies, SINs and emails are removed before sending). The detail and the legal basis (s. 17 of Law 25, privacy impact assessment) are in the Privacy Policy, section 5. On top of these five flows, and only if you connect your account: sending your accounting records to your own QuickBooks Online (Intuit, USA) — and, if you turn on online payment of your invoices, their settlement into your own Stripe account (USA).

The restore is actually verified, not just the backup.

A copy was fully restored and read back on September 23, 2026; the exercise is repeated every quarter.

Every night, a complete copy, encrypted before it leaves the server, is deposited with a second provider, in Montréal.

Rights are write-only: a compromised machine cannot erase the copies. Retention: 7 days for daily copies, 35 days for weekly, 366 days for monthly.

The night backup is monitored: if it doesn't run, an alert goes out.

A scheduled-task monitor waits for the signal every night, with two hours of tolerance.

Three external probes check the service every five minutes, since August 9, 2026.

They don't depend on our servers: if BatiCore stops responding, the founder is alerted.

Application errors are captured and grouped, server-side and browser-side, without personal data.

An incident is seen before a client writes about it; reports are scrubbed before leaving our servers.

Seven roles, and every permission is verified by the server — not just hidden on screen.

Owner, Administrator, Project manager, Finance and HR, Estimator, Site supervisor, Field: a Field account clocks its hours and sees the job sites, but not clients, estimates, invoices or payroll.

Two-factor authentication (authenticator app) with backup codes; Google or Microsoft sign-in possible, with the second factor enforced.

The second factor is each user's choice; it becomes mandatory as soon as you sign in through an identity provider.

Passwords never stored in clear (transformed irreversibly); sign-in limited to ten attempts per minute.

Brute force is slowed by the server, not by the browser.

Short sessions: a 15-minute access token renewed silently, a 7-day session (30 with "Remember me").

Tokens live in cookies inaccessible to scripts; "Sign out other devices" revokes sessions in one gesture.

Isolation per company: every request is tied to your company, and two internal audits verified it.

Security and Law 25 audit in July 2026 (no leak between companies found); second audit in August 2026, with hardening delivered right after: stronger two-factor chain, token renewal, protection against forged requests, shared rate limiting.

API keys (Enterprise plan) with their own permissions, every action logged with the key identifier.

A key cannot create another one, and the owner cannot use one as a shortcut.

Every sensitive action is recorded with its author, its date and its company — and every entry carries the digital fingerprint of the previous one.

Modifying, deleting or reordering a line breaks the chain, and the verification detects it.

Estimate signatures are legally valid in Québec (LCCJTI): digital fingerprint of the document, timestamp, IP address and explicit consent recorded.

The client signs from a private link, without creating an account; the signed PDF and its fingerprint are kept.

In transit: everything is encrypted, everywhere. At rest: the files in their storage, and every backup before it even leaves the server.

A file or a database copy taken out of its context is unreadable.

Inside the application, with strong encryption: the social insurance numbers of employees and subcontractors, and the second-factor secrets.

Encrypted with a key the database does not know; a keyring allows rotating that key without interruption.

Export of a client's or an employee's information, and anonymization on request (right to erasure), from the application.

Anonymization erases personal information and keeps the records subject to legal retention; every anonymization is recorded in a register, as is every confidentiality breach.

A person in charge of the protection of personal information can be designated by written delegation; otherwise, the function falls to the owner.

That's section 3.1 of Law 25, tooled rather than left to goodwill.

At the end of the subscription, the account becomes read-only: your data stays viewable and exportable, with no time limit.

CSV and Acomba exports of invoices, payments and journals; per-person export for Law 25.