Security & Trust Center
Encryption by default, Canadian hosting for customer data, and every security control published in full. Documentation is available for procurement review.
- PIPEDA
- Aligned
- Quebec Law 25
- Applies
- Penetration test
- May 2026
- Hosting
- AWS ca-central-1
- 63 controls
- Published
Encrypted by default
TLS 1.3 negotiated in transit with a TLS 1.2 floor, and AES-256 at rest on the database.
Customer data hosted in Canada
Asset records, work orders, documents and their backups live in AWS ca-central-1. The services that do not are named below.
Every control published
63 security controls, each with where we stand and the evidence behind it. No gated questionnaire to find out.
How your data is protected
Independently tested
Third-party penetration testing
- Most recent test
- May 2026
- Performed by
- Qualified external security firm
- Findings
- Tracked to closure
- Report
- Available under mutual NDA
We commission third-party penetration tests to validate our security controls and identify vulnerabilities before they can be exploited. Each finding carries a regression test that fails against the unfixed version, so a fix cannot silently regress. Customers and active evaluations can request the full report under a mutual NDA.
Encryption
- TLS 1.3 is negotiated with modern clients. TLS 1.2 is the floor, and TLS 1.1 and below are rejected.
- AES-256 at rest - database encryption via Supabase enterprise infrastructure.
Application security
- Row-Level Security - PostgreSQL RLS ensures complete data isolation.
- Multi-tenant isolation - organization-based data segregation.
- Audit logging - every external API call, including reads; deletes of core records such as assets, work orders, sites and projects, captured by a database trigger; and a field-level change history on asset records. Other activity in the web interface, such as reads, role changes and settings changes, is not yet individually logged.
Access management
- Role-based access control - Administrator, Manager, Staff, and Requester roles.
- Single sign-on - Enterprise customers configure Okta, Entra, Google, or a custom SAML/OIDC connection themselves under Settings → SSO, with the ACS URL, SP entity ID and metadata URL shown on screen for the identity provider.
- Private file storage - photos and attachments on assets, work orders and work requests are served through short-lived, access-checked links, the same way documents are.
Backup & recovery
- Automated Backups - Daily backups from the managed data tier. Point-in-time recovery is available from that provider and is not presently enabled, so the recovery point objective is up to 24 hours.
- Independent Offsite Copies - Nightly encrypted copies of the database and storage buckets, and a weekly identity export, to a separate provider in AWS ca-central-1. Archives are encrypted client-side before upload with a key held by AssetLab and never by the storage provider, so the storage provider holds ciphertext it cannot decrypt. Object-lock immutability means a credential compromise cannot destroy backup history.
- Disaster Recovery - Documented procedures for rapid recovery
- Customer-Initiated Export - Export your data at any time via the interface (CSV) or the API (JSON)
Where your data lives
Where it’s stored
Operational data hosted in Canada
- Primary region
- AWS ca-central-1, Montreal
- Backups
- Same region
- Processing outside Canada
- Named below
- Governing law
- PIPEDA, Law 25, provincial
Your asset data is stored in Canada. Asset records, work orders, work requests, compliance records, projects, vendors, custom fields, attachments and audit logs are stored in AWS ca-central-1 in Montreal, and so are their backups.
Some processing happens outside Canada:
- Sign-in (Clerk, United States). Clerk handles login and holds user accounts. We keep a small copy in Canada (user ID, name, business email and role) so the app can check permissions and write audit logs.
- Email (Resend, United States). Notification emails pass through Resend, including the record excerpts and messages listed on the sub-processor page. If you turn on email intake, incoming messages pass through it too.
- Error reports (Sentry, United States). When the app hits an error, Sentry receives the error message and stack trace, tagged with the organization, role and screen. No user information is attached: no name, email address or user ID, and IP address, user agent and URL capture, activity breadcrumbs and session replay are all switched off. Email addresses and tokens are stripped from error messages before they leave the browser.
- Network edge (Cloudflare, global). All traffic passes through Cloudflare’s firewall, which decrypts it for inspection and keeps request logs, including IP addresses. It doesn’t store asset records or documents.
- AI assistant connector (Cloudflare, global). If you connect an AI assistant (off by default), requests run on the Cloudflare server nearest the caller, usually outside Canada. Records pass through while the request runs and nothing is stored. Your API key is kept there encrypted.
- Edge Functions and file delivery (Supabase, global). Supabase Edge Functions and the Storage CDN are global services with no in-region setting. Edge Functions reach the database over the same authenticated path as any other client; the database and file storage themselves run in Canada.
- REST API region. The API runs in the region nearest whoever calls it, so a request from a server in the United States is processed there. Send the x-region: ca-central-1 header (or forceFunctionRegion=ca-central-1 in the query string) to keep processing in Canada. The AssetLab MCP server sends it for you.
If your organization has a legal requirement about where data is stored or accessed from, tell us before you sign and we'll confirm our position in writing.
Cloud infrastructure
- Supabase Enterprise - PostgreSQL database with enterprise-grade reliability.
- Canadian data centers - AWS ca-central-1 region in Montreal.
- Auto-scaling - automatically scales to handle peak demand.
- Global CDN - fast asset delivery worldwide via edge network.
Uptime & monitoring
- 99.5% availability SLA - a monthly availability commitment backed by service credits, available on Enterprise subscriptions where the order form incorporates the AssetLab Service Level Agreement. Availability for other subscription tiers is addressed in Section 9.1 of the Terms of Service, and no service credits apply.
- Continuous monitoring - application and REST API polled from multiple locations.
- Public status page - live uptime and 90 days of incident history, open to everyone.
- Maintenance windows - scheduled maintenance runs Tuesday and Saturday, 02:00-05:00 Pacific, with at least 72 hours' notice where it is expected to interrupt service.
Third-party sub-processors
The published sub-processor list referenced by Section 8.7 of the Terms of Service, Section 5.1 of the Privacy Policy, and Annex 3 of the AssetLab Data Processing Agreement. Every sub-processor is bound by a written data processing agreement with obligations no less protective than those in our DPA, and AssetLab remains liable to customers for their acts and omissions.
See all 6 sub-processorsData Processing Agreement
Available for customers who require formal documentation of how we process personal data on their behalf. It carries the EU Standard Contractual Clauses (Modules Two and Three), the UK International Data Transfer Addendum and a Swiss addendum, together with the technical and organizational measures and the authorized sub-processor list. The DPA is not self-executing and takes effect only on execution by both parties.
Request the DPAPrivacy and your rights
PIPEDA aligned
- Privacy by design - security and privacy considered in every feature.
- Transparent handling - clear documentation of data processing activities.
- User consent - consent collected before gathering personal information.
Privacy principles
- No data selling - we never sell, trade, or rent your data to third parties.
- Minimal collection - we only collect data necessary to provide our services.
- Transparent processing - clear documentation of how we use your information.
- User control - you maintain full control over your data at all times.
Your data rights (PIPEDA)
- Right to access - request a copy of all your personal information.
- Right to correction - request corrections to inaccurate data.
- Right to deletion - request deletion of your account and associated data.
- Data portability - export your data in common formats (CSV, JSON).
Responsible disclosure
If you believe you've found a security vulnerability in AssetLab, we want to hear about it. Email security@assetlab.ca with the details and we'll follow up. Our contact details are also published in security.txt.
Questions from your security team?
We provide additional documentation for enterprise procurement and compliance reviews, including the DPA and the penetration test report under NDA.
