OpsSecureHub
Privacy
This policy explains how OpsSecureHub, a platform backed by SOFT M POWER CANADA, collects, uses, discloses and protects personal information, in accordance with Quebec’s Act respecting the protection of personal information in the private sector (Law 25) and the Personal Information Protection and Electronic Documents Act (PIPEDA).
1. Person in charge of the protection of personal information
SOFT M POWER CANADA’s person in charge of the protection of personal information oversees compliance with this policy. Title: [to be completed]. Contact email: [to be completed]. Any question, request to exercise your rights or complaint may be sent to this person.
2. Two distinct roles
Two roles must be distinguished. First, data processed in the platform on behalf of customers — security events, alerts, inventories and tickets: OpsSecureHub then acts as a service provider on the customer’s behalf, and the customer remains responsible for that information under Law 25. We process it only according to the customer’s instructions and the contract, and requests from individuals are forwarded to the customer. The browser extension analyzes locally: text never leaves the workstation. Second, information we collect ourselves — the site’s access request form, console user accounts and addresses that receive service emails: SOFT M POWER CANADA is responsible for it.
3. Information collected
Access request form: name, work email, company, segment and message. User accounts: name, work email, role, organization, language preferences, optional profile photo, two-factor authentication factors and sign-in logs. Customer security data: events, alerts, software and AI component inventories, vulnerabilities and incidents, processed on behalf of each customer. The agent transmits no secret values or file contents: only names (software, components, variables) and metadata.
4. Purposes
We use this information to respond to access requests, create and administer accounts, provide the cybersecurity service (inventory, vulnerability intelligence, detection, CCSPA readiness and reports), secure the platform, keep an audit log and meet our legal obligations. We do not sell personal information or use it for advertising.
5. Consent
By submitting the form, you consent to the processing of your information to answer your request. For accounts, processing relies on your consent and on performance of the contract with your organization. Security data is processed according to the customer’s instructions; the customer remains responsible for informing its own users. You may withdraw your consent at any time, subject to legal or contractual obligations. External addresses receive no notices without express consent confirmed through a link; they may unsubscribe in one click, including from critical alerts.
6. Retention periods
Personal information is kept for as long as necessary for the purposes for which it was collected or as required by law, then destroyed or anonymized. Security events: kept for 15 months (450 days) and then deleted automatically, except those linked to an incident, which are kept as long as the incident record requires.
7. Recipients and service providers
Access is limited to authorized people according to their roles. We use service providers bound by contract: hosting of the platform’s database and functions in a Canadian region; an AI service used for explanations, which receives only the minimized data required, after verified facts. Service emails (alerts, reports and invitations) are delivered through an email delivery service provider. Their content is limited to the necessary minimized facts, without sensitive data or secrets; security details remain available in the console to authorized people. The current list of service providers is available on request.
8. Disclosure outside Quebec
Platform data is hosted in Canada, which may involve disclosure outside Quebec. Before any disclosure outside Quebec, we carry out a privacy impact assessment as required by Law 25 and govern the disclosure by contract. The servers of the service email delivery provider may be located outside Quebec, including in the United States or the European Union. These disclosures must undergo the assessment and contractual safeguards required by Law 25; this policy does not guarantee compliance. Details of AI processing are specified before activation.
9. Security
Measures in place: encryption in transit and at rest, strict per-customer data isolation, invitation-only access, two-factor authentication for administration, least privilege, an audit log chained with SHA-256 hashes, and time-limited download links.
10. Your rights
You may request access to your information, its correction, withdrawal of your consent, de-indexing or deletion where the law allows, and portability of your information in a structured, commonly used technological format. We respond to any access or correction request no later than 30 days after receipt, as required by PIPEDA (s. 8(3)) and, in Quebec, by the Act respecting the protection of personal information in the private sector (s. 32). You may file a complaint with the Commission d’accès à l’information du Québec (CAI) or the Office of the Privacy Commissioner of Canada.
11. Cookies and trackers
The site uses no advertising trackers or profiling tools. Only technical local storage is used to remember your language, your theme and, in the console, your session.
12. Confidentiality incidents
Every confidentiality incident is recorded in a register. When it presents a risk of serious injury, we promptly notify the CAI or the Office of the Privacy Commissioner and the individuals concerned, and take steps to reduce the risk.
13. Automated decisions
Security assessments rely on deterministic rules and verified facts; AI restates those facts. No decision about an individual is made solely through automated processing: a human decision remains necessary.
14. Policy updates
We may amend this policy. The version date appears at the bottom of the page; significant changes are communicated to customers before they take effect.
15. Contact us
For any question: write to the person in charge of the protection of personal information (contact details in section 1) or use the access request form. Never send secrets or sensitive data through this form.
Version of October 28, 2026.
Contact