We hold Probity IQ to the standard it sells.

Probity IQ exists to prove that AI is handled responsibly. That obligation starts with us. This page sets out how we secure your data, protect privacy, keep your information in Canada, and govern our own AI.

Security

Security is built into the platform rather than added afterward. Our practices include:

• Encryption of data in transit and at rest, across the application database and object storage.
• Least-privilege access, with multi-factor authentication and role-based access controls for staff and customers.
• Secrets held in managed stores, never in source code.
• An immutable audit log of access and changes.
• A secure development process, dependency and vulnerability management, and ongoing monitoring with alerting.

For questions about our security program, contact security@probityiq.com.

Tenant isolation

Probity IQ is multi-tenant by design and isolates every organization's data from every other. Access is denied by default, and each request is scoped to a single organization before any data is read. We treat cross-tenant isolation as a required, tested control, not an assumption.

Privacy and data handling

We are transparent about what we collect, why, how long we keep it, and who we share it with. For most of the data that flows through the platform, the interaction records your AI systems generate, Probity IQ acts as a service provider that processes that information on your behalf and under your instructions. You remain responsible for the personal information you send us, and our handling of it is governed by your agreement with us.

We practice data minimization, support redaction, apply configurable retention, and honour deletion. A Data Processing Agreement is available on request. Full detail is in our Privacy Notice.

Data residency

Probity IQ is Canada-first. Customer data is stored in Canada. Where any processing would occur outside Canada, we apply appropriate safeguards and assess the transfer in line with Canadian privacy law, including Quebec's Law 25.

Responsible AI

We govern our own AI with the same discipline we ask of customers. Probity IQ's own AI features are run through Probity IQ, and we are glad to share our own scorecard. Our commitments:

• Human oversight of consequential outputs, with clear escalation.
• Evidence over assertion: our findings are traceable to the behaviour that produced them.
• We do not expose the names of underlying model or infrastructure providers in customer-facing surfaces, and we measure the quality of our own AI review layer against a held-out evaluation set.

Compliance and certifications

Probity IQ is designed around Canadian obligations, including PIPEDA and Quebec's Law 25, and is mapped to our published control framework. We are honest about where we are on formal certification:

We will update this page as each milestone is reached, and we will not claim a certification we have not earned. To request our current security documentation, contact security@probityiq.com.

Sub-processors

We use a limited set of vetted service providers to operate the platform, for example hosting and infrastructure. We maintain a current list of sub-processors and the data they handle, available on request at privacy@probityiq.com. We require appropriate security and privacy commitments from each.

Report a concern

If you believe you have found a security vulnerability, please report it to security@probityiq.com. We will acknowledge your report and work with you in good faith to resolve it. Please do not publicly disclose an issue until we have had a reasonable opportunity to address it.

For privacy questions or requests, contact privacy@probityiq.com.