Security Policy

    Last updated: 12 October 2026

    Tax slips are among the most sensitive types of information. This page describes in concrete terms how DaxioOS Solutions Inc. protects DaxioOS Tax Agent and the data entrusted to it by firms.

    1. Hosting in Canada

    • The database is hosted in Montréal (Amazon Web Services).
    • Slips are read using artificial intelligence in Toronto (Microsoft Azure).
    • Slips and tax data are never hosted outside Canada.
    • Our infrastructure providers hold recognized independent security certifications, such as SOC 2 or ISO 27001.

    2. Encryption

    • All communications between the application, our servers and our providers are encrypted (HTTPS/TLS).
    • The database and its backups are encrypted at rest.
    • The session stored on your computer is encrypted by Windows.

    3. Access and authentication

    • Mandatory second factor: each sign-in requires, in addition to the password, a 6-digit code generated by an authenticator application.
    • Strong passwords: at least 12 characters of four types; passwords known to have been leaked are rejected.
    • One account per person, opened and closed at the request of the firm’s administrator.
    • Strict separation of firms: each firm can see only its own data. This rule is enforced by the database itself, not just by the application.
    • Limited internal access: only the founder has access to system administration, with a second factor on every account; her access is logged.

    4. As little data as possible

    The best way to protect data is not to keep it.

    • Slips are read and then are not retained on our servers.
    • Neither the name nor the social insurance number read from the slips is recorded in our database.
    • Extracted amounts are automatically destroyed after 90 days.
    • The import file is sent directly to the firm’s computer and is not retained on our servers.

    5. A locked-down desktop application

    • The application reads only the files chosen by the user.
    • It does not load any external content and operates with its engine’s isolation protections enabled.
    • Updates are distributed by DaxioOS and installed from within the application.

    6. Development and monitoring

    • Every change undergoes automated tests and a review before being put into production.
    • The code undergoes security audits, and identified deficiencies are corrected.
    • No real client data is used in the code.
    • Sensitive actions are recorded in a log that cannot be modified, retained for 1 year.
    • The database is backed up daily.

    7. In the event of an incident

    We follow a written procedure. If an incident affects a firm’s data, we notify the firm without delay, take measures to limit harm and help it notify its clients and the authorities where appropriate. Every incident is recorded in a register retained for at least 5 years.

    8. What we ask of you

    Security is a shared responsibility. We rely on each firm to:

    • never share an account or authentication code;
    • promptly ask us to close the account of anyone leaving the firm;
    • lock computers (Windows session) and keep antivirus software and Windows up to date;
    • protect import files saved on its computers;
    • write to us immediately if there is any concern about an account or computer.

    9. Contact us

    For a security question or to report a vulnerability: contact@joindaxioos.com. We respond promptly and thank anyone who reports a problem to us in good faith.

    To learn more about your personal information, see our Privacy Policy.