Security Practices

Our approach

Security is built into how the Service is designed, operated and maintained. This page summarizes the principal safeguards that protect the information entrusted to KYP Manager. Details that could assist an attacker are deliberately not published.

Authentication and access control

Every account, staff and client alike, signs in with multi-factor authentication, and that requirement is enforced at the data layer rather than only at the sign-in screen. Sign-in attempts are throttled, and sessions expire automatically. Access within the Service is role-based and least-privilege: staff see only what their role permits, Firms can restrict advisors to their assigned clients, and clients see only what their Firm makes available to them.

Data protection

All data is encrypted in transit and at rest. Sensitive fields are additionally encrypted at the application layer, with encryption keys managed separately from the data they protect. Each Firm's data is logically isolated from every other Firm's, and that isolation is tested automatically before every release. Primary data storage is located in Canada, and regular backups are maintained.

Monitoring and auditability

Activity within the Service is recorded in tamper-resistant logs that support supervision, incident response and regulatory review. Clients with portal access can view a log of activity on their own documents.

Application and infrastructure security

The Service applies industry-standard web-security protections, enforces authorization on the server for every request independently of what the interface shows, and runs on established cloud infrastructure. Software dependencies are monitored for published vulnerabilities and updated, and every release passes automated testing before it is deployed.

Sharing controls

When a Firm shares a document outside the Service, for example with a client's accountant or lawyer, it does so through a time-limited link that can be revoked at any time, and every access through such a link is recorded.

Continuous improvement

We review our safeguards regularly and continue to strengthen them as the Service and the threat landscape evolve.

Reporting a concern

If you believe you have found a vulnerability or a security incident, contact your Firm or the platform operator immediately. We investigate every report and will notify affected Firms without undue delay if an incident affects their data.