Legal · Profit First Canada
Security Policy
Last updated 21 September 2026
1. Our commitment
We hold information about our certified professionals and about people who contact them through our directory. This page describes, honestly, how we protect it.
We have deliberately written this to describe what we actually do rather than to sound impressive. Where we do not hold a formal certification, we say so.
2. Data storage and backups
Information about members and directory enquiries is held in managed databases operated by our infrastructure providers, in facilities with physical access control and 24/7 monitoring. Databases are backed up on an automated schedule, and backups are held separately from the live system.
3. Encryption in transit
Every page and form on profitfirstprofessionals.ca is served over HTTPS (TLS). Information you type into a form is encrypted between your browser and us. Connections between our own systems and the services we use are likewise encrypted.
4. Hosting and infrastructure
Our website runs on HubSpot's hosting platform. Our directory and enquiry handling run on Cloudflare's network. Both are established providers that maintain their own security programmes and independent audits.
We keep production credentials out of source code, rotate them on a schedule, and restrict them to the specific systems that need them.
5. Payments
We do not store payment card details. Payments are processed by Stripe, a PCI DSS Level 1 certified provider. Card details go directly to Stripe and are never held on our systems.
6. Access control
Access to member and enquiry information is limited to the people who need it to do their work, and is removed when they no longer need it. Administrative access requires individual accounts — we do not use shared logins — and actions taken in our administrative tools are logged.
7. Email
Email we send is authenticated with SPF, DKIM and DMARC so that recipients' mail systems can verify it genuinely came from us and can reject messages that forge our domain.
8. What we do not claim
We are a small Canadian company. We do not currently hold SOC 2, ISO 27001 or any comparable third-party security certification, and we would rather tell you that than leave the impression that we do. The providers we depend on — HubSpot, Cloudflare, Stripe, Google — hold their own.
9. If something goes wrong
If we become aware of a breach of security that creates a real risk of significant harm to anyone whose information we hold, we will notify the Office of the Privacy Commissioner of Canada and the affected individuals, as PIPEDA requires, and we will keep a record of the breach.
10. Reporting a concern
If you believe you have found a security problem, please tell us — see our Vulnerability Disclosure page for how, and for our commitment not to pursue researchers who report in good faith.
Contact us
Profit First Professionals Canada Inc. 120 East Beaver Creek Road, Suite 200 Richmond Hill, ON L4B 4V1 Canada