How we protect your team's data

Personal information categories covered

Identity, contact, authentication identifiers and credentials processed by our authentication provider (WalnutsHR never holds plaintext passwords), employee HR records (with sensitive fields encrypted at application layer), performance and time-off data, uploaded documents, support communications, AI prompt content (only when invoked), and device / network / usage metadata (only with explicit analytics consent).

Destination jurisdictions assessed

Canada and the United States. Supabase primary storage for Canadian organizations is provisioned on AWS Canada Central (ca-central-1). Supabase is a non-Canadian provider and AWS is a US-based infrastructure provider. The assessment also covers US infrastructure or access for the other sub-processors listed in Privacy Policy §4.2, US federal law (including CLOUD Act and FISA §702 exposure), the state-law layer (CCPA/CPRA and successors), and a per-recipient analysis of each sub-processor's contractual, technical, and organizational safeguards.

Operational mitigations in production

• Standard Contractual Clauses (or equivalent) with every US-based sub-processor
• Application-layer AES-256-GCM encryption for SIN, bank account, and bank transit numbers, in addition to the cloud provider's at-rest encryption
• Postgres row-level security on every model; column-level revocation of salary, SIN, bank, and tax fields from the public-API role
• Sentry payload scrubbing strips password, SSN, bank, salary, token, and authorization headers before transmission
• AI invocations only on explicit user action; prompt content fenced; no background AI processing of Quebec residents' data
• Explicit, granular consent captured at signup with audit trail (purpose, policy version, IP address, timestamp)
• Customer-data deletion lifecycle: 60 days paused → 270 days archived → 30 days final notice → permanent deletion; backup purge within 30 additional days

Residual risks acknowledged

US government compulsion under the CLOUD Act, FISA §702, or domestic process remains a residual exposure for US-headquartered providers and US infrastructure, including providers used for Canadian-region primary storage. That storage is data residency only, not data sovereignty; this legal-process exposure is mitigated by encryption-at-rest, data minimization, access controls, and contractual notification requirements where lawful. Sub-processor breach risk is mitigated by SOC 2 Type II certifications and our layered technical controls but cannot be eliminated. AI provider prompt retention is the highest-attention residual; we reassess every six months and will route Quebec-customer AI invocations to a Zero-Data-Retention vendor if one becomes available with comparable capability.

Conclusion (pre-publication)

The draft PIA records the Privacy Officer's preliminary view that the transfers and provider arrangements listed in Privacy Policy §4.2 may be supportable under Article 17 if the documented mitigations remain in force and the annual PIA review cycle is followed. That view is not final and should not be relied on as a legal opinion until Quebec privacy counsel has completed review and the PIA has been approved.

Privacy Officer + complaints

Quebec residents with questions about this assessment, or who wish to challenge any cross-border transfer of their personal information, may contact the WalnutsHR Privacy Officer at privacy@walnutshr.com. Complaints unresolved through that channel may be filed with the Commission d'accès à l'information du Québec.