Privacy policy

1. Controller and privacy officer

The controller is RISS Canada Inc. (Montreal, Quebec). In accordance with Law 25 (s. 3.1), the person in charge of the protection of personal information is:

Olivier Guidici, President of RISS Canada Inc.
Email: [email protected] (subject “Personal information protection”)
Address: RISS Canada Inc., Montreal, Quebec, Canada.

You may contact this person with any question about this policy or to exercise your rights (section 6).

2. Information collected and purposes

Processing	Data	Purpose	Retention
Contact form	Name, email, organization, need, message, language and page of origin	Answering your request	Nothing is stored on the site: the message reaches us by email and stays in our mailbox while we handle your request and follow up on the relationship
Posture assessment	Your answers stay in your browser. The site only receives your sector, your level and your exposure by domain	Computing your score; anonymous statistics	No personal information: only anonymous daily counters, with no IP address and no answers
Assessment: personalized advice (on request)	Email, timestamped consent (accepted text, language, page), sector, result and answers, wish to be contacted	Sending your advice once your address is confirmed (double opt-in); contacting you if you ask	30 days if the address is not confirmed; otherwise 12 months after your consent, then automatic deletion
Personalized white paper (on request)	First name, company, size, role, all optional, in addition to the assessment data	Writing your white paper	Deleted with your advice, at most 12 months
FAQ assistant and threat watch search	Your question	Answering you	Unanswered questions: text only, with emails, links and numbers masked, 90 days
Site protection	Hashed IP address (keyed fingerprint)	Rate limiting and abuse blocking	From 1 minute to 24 hours
Technical logs	IP address, requested page, browser	Server operation and security	Limited time, through automatic log rotation

We apply data minimization: nothing is collected beyond what is necessary. Requests received on the previous version of the site keep their original deletion date. A review area reserved for our authorized collaborators keeps their email address and an access log.

3. Cookies

This site sets no cookies on its visitors, neither advertising nor tracking. We measure traffic with Cloudflare Web Analytics, which works without cookies or identifiers and only produces aggregate statistics. Your browser stores a few preferences locally (light or dark theme, assessment answers in progress): they are never sent to us. A session cookie is only set for authorized people who sign in to the administration or the review area. This is why no consent banner is required.

4. Automated processing and artificial intelligence

In the interest of transparency (Law 25, s. 12.1): no decision about you is made by automated processing. The assessment score comes from a fixed calculation, without AI, and contact form messages are read by a person.

The personalized white paper, which you request yourself, is partly written by an AI model (Claude, from Anthropic), called through a gateway operated by RISS in France. We send it your company, your role, your result and your assessment answers, never your email or first name. The FAQ assistant and the threat watch search send your question to AI models available through the Ollama service, via a relay operated by RISS. RISS does not reuse your answers to train models.

5. Disclosure and service providers

Your information is never sold. It only goes through:

Provider	Role	Location
OVHcloud	Hosting of the site and its database	Beauharnois, Quebec
Cloudflare	Content delivery network, application firewall, cookieless traffic measurement	International
Google (Gmail)	Delivery of the site’s emails	United States
Anthropic (Claude), through the RISS gateway in France	Writing the personalized white paper	United States
Ollama, through the RISS relay	FAQ assistant and threat watch search	International

The site and its database are hosted in Quebec. The transfers outside Quebec listed above are covered by a privacy impact assessment (PIA), as required by Law 25.

6. Your rights

You have the rights of access, rectification, withdrawal of consent, deletion and, under the GDPR, portability. The link in every assessment email lets you unsubscribe or delete everything yourself, at any time. For anything else, write to [email protected]: we answer within the 30 days set by law. You may also contact the Commission d’accès à l’information du Québec (CAI) or, in Europe, your supervisory authority.

7. Security and incidents

Measures in place: encryption in transit, hosting in Quebec, application firewall and abuse protection, restricted administrative access, automatic purges, daily backups kept for 7 days (deleted data may therefore remain in them for up to 7 days). Any confidentiality incident presenting a risk of serious injury is recorded in the incident register and reported to the CAI and to the people concerned, as required by law.