Security and your data
We have no badges to show you.
Most software in our market answers this question with a logo — a certification mark, a compliance seal, a customer count. We have none of those, and inventing the impression of one would be worse than having none. So this page does the other thing: it tells you exactly what we do with your firm’s information, and exactly what we have not done.
What we do
Six things that are true today.
Each of these is also stated in the privacy policy or the terms of use, which are the documents you can hold us to.
One organisation's data is separated from another's
Access to the information in an application is restricted, and one organisation's records are separated from another organisation's. Reaching into another organisation's data is also a breach of the terms of use.
Sign-in is one account, centrally removable
People sign in at accounts.cloudversa.io, not app by app. Accounts belong to named people rather than to shared mailboxes, and removing someone from your organisation removes their access to every app at once.
We never hold your card details
Payment is taken by Square. Card details are entered with Square and held by Square. We see that a payment succeeded — not the card.
This website runs no third-party scripts
No analytics, no tag manager, no chat widget, no marketing pixel, no externally hosted library. Fonts are served from this origin. You can confirm it in your browser's network tab.
Tokens for services you connect are held encrypted
Where an application connects to an outside service your firm already uses, the access tokens for that connection are held encrypted, and the connection can be disconnected by your organisation.
Your data stays yours, including on the way out
We do not sell your organisation's information, share it with anyone but the providers named in the privacy policy, or use the contents of your records to build products for anyone else. If you stop using CloudVersa, ask us and we will give you a copy of your data in a reasonable format before it is removed.
What we have not done
The part a competitor leaves off the page.
If one of these matters to your firm, it is better that you know now than after you have moved your files.
We have no external security certification
No SOC 2, no ISO 27001, no independent audit. We have not been assessed against any external security or compliance standard, and we will not imply an assessment we have not had.
We do not publish an uptime or response-time commitment
CloudVersa is under active development. We do not promise a particular level of availability, a response time, or that the service will be uninterrupted or free of errors.
Data may be processed outside Canada
Our providers operate in more than one country, so information may be stored or processed outside Canada, including in the United States, and may be subject to the laws of those countries. If you need to know where a specific piece of information is held, ask us.
If a particular standard matters to your business, ask us where things stand before you rely on it. We will tell you plainly, and we will not tell you an assessment is under way when it is not.
Who else touches it
The providers that process information for us.
This is the whole list. Each receives only what it needs, and each acts on our instructions. If we add or replace one, the privacy policy changes and its date moves.
- Vercel
- Hosts this website and the applications.
- Supabase
- Provides the database and the sign-in service behind accounts.cloudversa.io.
- Square
- Takes payment and holds card details.
- Google Workspace
- Carries our own email, including messages sent through the contact form.
The full statement, including what we collect and how to ask for a copy or a deletion, is in the privacy policy.
This website
Nothing on this page is watching you.
The rule is not a preference. The platform's sign-in cookie is scoped to cloudversa.io, so any script served from this host would be able to read a signed-in customer's session. We therefore serve none that we did not write.
No analytics, no tag manager, no chat widget, no marketing pixel, no A/B testing snippet, no externally hosted library. Typefaces are downloaded at build time and served from this origin. Open your browser’s network tab on any page of this site and check — that is the kind of claim we are willing to make, because you can verify it yourself in ten seconds.
Ask us the awkward question.
Where is a particular record held? What happens to it if we leave? What would you do if there were a breach? Send it, and a person will answer — or tell you we do not have an answer yet.