A human-scale team, an uncompromising standard

Who is RISS Canada, in verifiable facts?

RISS Canada Inc. is a business corporation constituted under the Quebec Business Corporations Act, registered with the Registraire des entreprises on 6 June 2014 under Quebec enterprise number 1170132139. It is led by Olivier Guidici, president.

These facts are publicly verifiable at the Quebec enterprise registrar, which is why we display them. In a market where many players present themselves with no identifiable legal existence, the enterprise number is the first indicator of seriousness a buyer can check themselves in under a minute.

Full contact details and the registered address appear in the legal notice.

• Legal form. Business corporation governed by the Quebec Business Corporations Act (CQLR, c. S-31.1).
• Registration. 6 June 2014, enterprise number 1170132139.
• Area served. Greater Montreal, Montérégie and all of Quebec, on site and remotely.
• Editorial responsibility. Olivier Guidici, president, signs the editorial content of this site.

How does a human-scale firm cover rare skills?

Through a two-ring model. A permanent core of architects and consultants provides relationship continuity and knowledge of your environments. A network of specialists is mobilised per engagement for the skills that demand does not justify keeping in-house full time.

This arrangement is a choice rather than a fallback. Banking Zero Trust, industrial OT/IT convergence and multi-jurisdictional compliance are rare skills: recruiting them full time would require a volume of engagements we do not have, and diluting them into a generalist profile would amount to no longer offering them.

The obvious risk of this model is discontinuity, and we address it in two ways. The permanent core stays your point of contact from start to finish, including when a specialist is involved. And operational documentation is a deliverable, precisely so that a specialist's departure does not leave you with an architecture nobody understands.

What are your values, and how can they be checked?

Four, phrased to be checkable rather than decorative: rigour, transmission, proximity, innovation. Each translates into a practice you can observe from the first engagement.

• Rigour. Every engagement is documented, tested and auditable. The check: ask for an anonymised sample deliverable before signing, and judge whether it would be readable by your board as well as by your technical team.
• Transmission. Knowledge transfer is a planned outcome of the engagement. The check: we accept becoming unnecessary, and our proposals say so in writing.
• Proximity. A permanent point of contact who knows your environment. The check: you do not have to re-explain your context at every conversation.
• Innovation. AI applied to security, on infrastructure whose location you control. The check: we name the applicable jurisdiction, not only the hosting country.

Why don't you resell licences?

Because a provider who sells the tool, deploys it and then verifies their own installation has a conflict of interest, even in good faith. By earning nothing from the choice of a product, we make our recommendations structurally neutral.

The practical consequence is visible in our assessments. Our first recommendation is frequently to enable security features already included in your existing licences rather than to buy anything. A reseller has no interest in giving that advice, and most do not give it.

It also lets us assess your managed IT provider without ulterior motive, verify their patching and notification commitments, and help you frame the questions you lack the technical means to ask yourself.

What is the relationship with RISS Consulting in France?

An operational partnership: shared methodologies, technology watch and specialists, and the ability to support an organization subject simultaneously to the European and Quebec frameworks. These are two distinct entities, not a subsidiary.

This bridge has concrete value for two profiles. Quebec organizations whose data or subsidiaries touch Europe, and which must reconcile Law 25 with the General Data Protection Regulation. And European organizations establishing themselves in Quebec, who find a framework similar in spirit but distinct in its obligations, particularly on disclosure of information outside Quebec.