Use dummy data where practical
We often need to understand how your files are organized and how the work is done. Where practical, we build and test with copies that use dummy values in place of client data.
Data & Security
How we handle your data
We agree the tools, access, and data needed before work starts. Where practical, we use dummy data to build and test the automation. If your firm has specific requirements, we discuss them before client material is shared.
Our commitments
Keep client data out of model training
We use established AI tools on paid plans with model-training turned off. We do not use free or consumer accounts for client work.
Limit what we collect and keep
When real data is needed, we take only what the task requires. We keep it in a secured cloud workspace and return or delete engagement materials when the work concludes.
Confidentiality is a professional duty
As a licensed CPA, confidentiality is bound by the CPA Rules of Professional Conduct, not only by contract. It is also covered by your engagement letter, and we are glad to sign your NDA or data processing agreement on request.
The tools we use
We use Anthropic, OpenAI, and Google on paid plans with model-training disabled. These providers maintain their own SOC 2 security programs. We also use Microsoft 365 and GitHub, but not their AI assistants. Only code goes into version control; client data is excluded.
Some processing happens outside Canada, including in the United States. Canadian data residency needs to be specifically arranged as part of an engagement.
Privacy and professional duties
Our practices follow the principles of Canadian privacy law, PIPEDA federally and BC's PIPA provincially: accountability, limited collection, limited use and retention, and safeguards proportionate to how sensitive the information is. In practice most engagement data is corporate information, not personal information; where personal information could be involved, we minimize it or design it out with dummy data. When an automation is meant to run on live personal data on an ongoing basis, it is built to run inside the client firm's own environment, where the firm operates it. InnovataxAI is led by a licensed CPA, so client work carries professional confidentiality obligations under the CPA Rules of Professional Conduct.
Ask before we start
If your team needs specific controls, a signed NDA or data processing agreement, tool restrictions, access logging, or a security review by your IT group, raise it in the first conversation and we will design the engagement around it.
Have a security question we didn't answer?
Send us your question or requirements before sharing client material.