Trust Center

Trust isn't a feature.
It's the foundation.

We handle sensitive health information, so we hold ourselves to real standards — and we're honest about where we stand on each. Here's how we protect your data.

Standards we hold to

PIPEDA Aligned

Canada's federal private-sector privacy law.

BC PIPA Aligned

British Columbia's privacy law — our home jurisdiction.

HIPAA-aligned Aligned

HIPAA-grade safeguards. OpenAI BAA in place; Google Cloud BAA in progress.

PCI DSS SAQ A

Payments handled by Stripe; card data never touches our servers (SAQ A).

How we protect your data

Data protection & residency

Where your data lives, who's responsible, and what we'll never do with it.

Subprocessors

The vetted providers we rely on, and where each processes data.

Accessibility

Our commitment to WCAG 2.1 AA so our tools work for everyone.

Documentation on request

Partners and standards reviewers can request our security overview, subprocessor list, and — as they become available — audit reports. We're building toward SOC 2; a report will be provided on request once complete. Detailed materials are shared under a mutual NDA.

Request documentation →

Privacy contact: Brett Poulin · contact@coldstream.info

Trust isn't a feature.It's the foundation.

Standards we hold to

How we protect your data

Documentation on request

Trust isn't a feature.
It's the foundation.