Security and incidents

How we protect data

Among other things:

• every connection is encrypted (HTTPS), and data is encrypted at rest by our hosting provider;
• each business's data is walled off from every other business at the database level;
• inside a business, roles limit who can see and change what;
• passwords are handled by our sign-in provider and never stored in plain text;
• card data is handled by the payment providers, never by us.

Your part

Use a strong password you don't use elsewhere, give each person their own account, and remove people who leave your business.

Report a vulnerability

Email customerSupport@igotyoubruhh.ca with "Security" in the subject and enough detail for us to reproduce it. Please don't access other people's data, disrupt the service, or share the issue publicly until we've fixed it. We'll acknowledge within 5 business days and keep you updated.

If there's a data breach

If personal information is lost, accessed or disclosed without authorization, we act promptly to contain it and reduce the harm, and we record every incident. If there is a risk of serious harm to anyone, we notify the Commission d'accès à l'information and the Office of the Privacy Commissioner of Canada, and we tell the people affected as soon as possible, including what happened and what they can do.