Privacy Policy — Dossiera

Last updated: July 4, 2026

1. Who we are

Dossiera is a document and accounting management service operated by M2atech Solutions Inc. ("M2atech", "we", "us"), a company incorporated in New Brunswick, Canada.

Controller / contact: M2atech Solutions Inc., contact@dossiera.ca.
Privacy officer: privacy@dossiera.ca.

This policy explains what information we collect, why, how we protect it, and your rights. It applies to the dossiera.ca website and the app.dossiera.ca application.

2. Our role: controller and processor

Dossiera is a tool intended for accounting firms and their clients. Depending on the context:

For firm information (user accounts, billing), we act as a controller.
For the documents and data that the firm and its clients upload (invoices, receipts, bank statements), we act as a processor (service provider) on behalf of the firm, which remains the controller of that information. We process this data only on the firm's instructions and to provide the service.

3. Information we collect

Account information: name, email, firm name, password (hashed), language, role, preferences.
Uploaded content: financial documents (invoices, receipts, statements) and the data extracted from them (amounts, taxes, dates, suppliers).
Integration data: access tokens for connected services (e.g. QuickBooks) — stored encrypted.
Technical data: IP address, access logs, device/browser type, for security and proper operation.
Communications: messages you send us (support, demo requests).

We never sell your personal information and do not display advertising.

4. Why we use this information (purposes)

Provide, maintain and secure the service (OCR extraction, categorization, sending to the connected accounting software).
Authenticate users and prevent fraud/abuse.
Communicate with you (service notices, support, billing).
Improve the service (in accordance with this policy).
Meet our legal obligations.

We process financial documents only to deliver the requested service, never to train AI models for general purposes.

5. Artificial intelligence processing

Extracting data from your documents uses AI services (Claude models). The request is issued from Canada (`ca-central-1`), but AI processing may take place outside Canada (United States) — via Amazon Bedrock (cross-region inference profile) and the Anthropic API (fallback). Your documents and extracted data are not retained by the AI providers beyond processing the request, nor used to train their models. The extraction result is suggestive: it is reviewed and validated by a human (the firm) before any accounting processing. Details: see Where your data is processed.

6. Where your data is hosted (residency)

Your data at rest is hosted in Canada; AI processing may be routed outside Canada (see §5):

Documents: Google Cloud Storage, Montreal (northamerica-northeast1) region.
Application and database: server located in Beauharnois, Quebec, Canada (OVH).
Encrypted backups: a dedicated Canadian bucket.
AI processing: Amazon Bedrock (call issued from ca-central-1) + Anthropic API fallback — the compute may run in the United States.

Some technical operations may temporarily transit through services located in Canada (e.g. an email-reception buffer in a Canadian region) before final storage in Canada.

7. Sharing and sub-processors

We share your information only with the sub-processors necessary to the service, bound by contract and required to protect it:

Amazon Web Services (AWS) — AI processing (Bedrock, cross-region profile — United States / global) and reception infrastructure (Canadian region).
Anthropic — fallback AI processing via the direct API (United States).
Google Cloud (GCP) — document storage, Canadian region.
OVH — application hosting, Canada.
Brevo — transactional email delivery.
Sentry — technical error tracking (where enabled; hosted outside Canada, EU/US region), configured without any personal information: no IP, no e-mail, no query values — only an opaque technical identifier.
QuickBooks / Intuit — only when you connect your account: we send to your QuickBooks file the data you approve. Your use of QuickBooks is governed by Intuit's terms.
Cloudflare — anti-bot protection (Turnstile) of forms.

We may disclose information where required by law (court order, legal obligation). In the event of a business transfer (merger, acquisition), information could be transferred, subject to this policy.

8. Transfers outside Canada

AI processing (OCR extraction by the Claude models) may take place outside Canada — in the United States, via our sub-processors AWS and Anthropic (see §7); your data at rest (documents, database, backups) remains in Canada. For these transfers, we take contractual and technical measures to ensure comparable protection, and we inform you in accordance with Law 25 and PIPEDA. [To be validated with a lawyer based on your actual sub-processors.]

9. Retention

We keep information as long as necessary to provide the service and meet our legal obligations. Uploaded documents are kept according to the firm's needs. On an account-deletion request, we delete or anonymize the information within a reasonable time [SPECIFY, e.g. 30–90 days], unless a legal retention obligation applies. Temporary buffers (e.g. email reception) are purged promptly [e.g. 24–48 h].

10. Security

We implement security measures including: encryption in transit and at rest, multi-factor authentication (MFA), strict isolation between tenants (firms/clients), role-based access control, file antivirus scanning, audit logging, and verification of inbound email. No system is infallible, but we take security seriously.

11. Your rights

Subject to applicable law (Law 25, PIPEDA), you may: access your information, request its correction, deletion, portability, withdraw your consent, and file a complaint. For documents for which the firm is the controller, address your request to the firm; we assist it as a processor. To exercise your rights, write to privacy@dossiera.ca. You may also contact the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

12. Cookies

We use cookies necessary for operation (session, security) and, where applicable, audience-measurement cookies. [Describe your actual analytics tools and consent, required by Law 25.]

13. Minors

The service is intended for professionals and is not directed at persons under [18].

14. Changes

We may amend this policy. For a significant change, we will notify you (email or in-app notice). The update date appears at the top.

15. Contact us

M2atech Solutions Inc. — contact@dossiera.ca.