Security

How we protect your data

Bank-Level Security

DocuQuire uses industry-standard security measures to protect your sensitive mortgage documents and personal information. We implement multiple layers of security to ensure your data remains safe and confidential.

Encryption

Data in Transit

All data transfers between your device and our servers are protected using 256-bit TLS encryption. This is the same level of encryption used by banks and financial institutions.

Data at Rest

All documents stored on our servers are encrypted using AES-256 encryption. Documents are stored in Backblaze B2 cloud storage with server-side encryption (SSE-B2), ensuring your files remain encrypted even when stored.

Data Residency

All data is stored in Canada (Toronto) to ensure compliance with Canadian data residency requirements and PIPEDA regulations. Your data never leaves Canadian borders.

Access Controls

  • Secure Authentication: Password hashing with bcrypt and protected API routes
  • Private files: Documents stay in a private bucket. DocuQuire signs a short-lived link only when an authorized person opens a file. There is no public file access.
  • Role-Based Access: Users can only access documents they are authorized to view
  • API Security: All API routes are protected with authentication middleware

Automatic Document Deletion

Uploaded documents are retained for 90 days after your last activity on a request. If a request has been submitted to a brokerage for compliance review, its documents and package are retained for 7 years from the submission date, in line with mortgage industry recordkeeping requirements. Retention is not based on plan tier.

Compliance

PIPEDA Compliant

DocuQuire is fully compliant with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal privacy law. We follow all requirements for the collection, use, and disclosure of personal information.

Security Audits

We conduct regular security audits and vulnerability assessments to identify and address potential security issues. Our infrastructure is continuously monitored for threats and anomalies.

Infrastructure Security

  • Secure cloud infrastructure with industry-leading providers
  • Regular security patches and updates
  • DDoS protection and network security measures
  • Secure payment processing through Stripe (PCI DSS compliant)

Your Responsibility

While we implement robust security measures, you also play a role in protecting your account:

  • Use a strong, unique password
  • Never share your account credentials
  • Log out when using shared devices
  • Report any suspicious activity immediately

Questions About Security?

If you have questions about our security practices or need to report a security concern, please contact us: