OpsSecureHub
Personal information: Quebec Law 25 and PIPEDA (federal)
Employees use AI services, sometimes without approval. OpsSecureHub spots these uses, analyzes on the device what is being sent and documents privacy incidents — without ever transmitting the content.
Shadow AI, finally visible
List the AI services used across the organization, approved or not. The usage policy is managed per service: approved, to review or rejected, with an internal note.
Chrome and Edge extension: analysis stays on the device
The extension locally analyzes what is typed into AI services. The text never leaves the endpoint: only the data type and count are transmitted. Policy is set per data type: log, warn, mask or block. Confidential keywords specific to your organization can be added, and deployment is done through Intune or GPO.
Windows agent: beyond the browser
DNS-based detection identifies AI services contacted by applications and scripts, not only by the browser. The software and AI component inventory completes the picture.
DLP and CASB connectors
Microsoft Purview DLP and Microsoft Defender for Cloud Apps feed findings: alerts from your Microsoft tools land in the same queue as those from the extension and the agent.
A personal information detector
Social insurance numbers, health insurance, cards and bank accounts, health data, secrets and credentials: the detector recognizes the data type. Only the type and count are transmitted, never the value.
Prompt injection protection: hidden instructions in pasted documents, invisible characters, responses attempting to exfiltrate the conversation, and dangerous commands — analysed on the endpoint; no text leaves the endpoint.
A privacy incident register
Findings feed a privacy incident register, currently in draft form: it prepares follow-up without replacing your official process.
A PDF report ready to share
The “AI usage, Law 25 and PIPEDA” report summarizes observed services, sensitive data sent or blocked, and the register, in French or English.
Elsewhere in Canada: PIPEDA
The Personal Information Protection and Electronic Documents Act (PIPEDA) currently applies to private businesses outside Quebec and to interprovincial exchanges. OpsSecureHub helps the same way: an inventory of what goes to AI, detection of personal information leaks, a privacy incident log and reports for breach reporting to the Office of the Privacy Commissioner of Canada (OPC) — the decision to report stays with the organization.
Federal reform: Bill C-36
Introduced on June 15, 2026, Bill C-36 would enact the Protecting Privacy and Consumer Data Act and replace Part 1 of PIPEDA. It is under study in Parliament; its obligations depend on its adoption and entry into force. OpsSecureHub is not a certification body and does not replace legal advice.
OpsSecureHub supports compliance; it is not legal advice. Qualifying a confidentiality incident and notifying the Commission d’accès à l’information remain the responsibility of the person in charge of the protection of personal information (s. 3.5 and 3.8 of the Act respecting the protection of personal information in the private sector).
OpsSecureHub
Your next security decision starts with a clear view.
Let’s discuss your AI use, your tools and your CCSPA readiness.