Where your documents go, and who can read them.

Québec, and Law 25

• Because the hosting is outside Québec, any personal information inside an extract is communicated outside Québec. Under the Act respecting the protection of personal information in the private sector, as amended by Law 25, that communication requires a privacy impact assessment before it happens.
• Fruxal's practical answer is to keep personal information out of what you send. Most documents a review reads are commercial records: contracts, invoices, supplier agreements, insurance policies. Some are not: payroll records and sales by customer can name people. For those, the document request asks for masked copies, with employees and customers identified by number and social insurance numbers removed. A document that arrives unmasked is deleted and a masked copy requested.
• Where personal information cannot be avoided, the assessment is completed with your privacy officer before the document is transferred, and the transfer is covered by a written agreement, as section 17 requires.
• Fruxal's privacy officer can be reached at privacy@fruxal.ca. A request for access, correction or deletion is answered within thirty days.

What Fruxal never receives

• Banking credentials. Where a client chooses to connect a bank account, the connection is made through Plaid and the credentials are entered on Plaid's screen, never on a Fruxal screen and never through a Fruxal server.
• A login to your accounting or ERP system, of any privilege level. A review runs from exports. The Fruxal platform can connect to QuickBooks on Intuit's own authorisation screen, but that is optional and not part of a review.
• Card numbers. Payments, where an engagement has one, run through Stripe, a PCI DSS Level 1 service provider.
• Write access to any system of yours. A review reads exports. It does not post entries, adjust vendors or send correspondence from your domain.

Encryption and access control

• TLS 1.2 or higher in transit. AES-256 at rest, on the hosting providers' managed encryption.
• The database refuses the public key. Every table is reachable only through Fruxal's own server, and review records only through Fruxal's review portal, behind a sign-in.
• Access to a review is limited to the representative assigned to it and an authorized administrator of Fruxal Technologie inc. A representative cannot see another representative's customers.
• Secrets and third-party tokens are held in the hosting provider's encrypted environment store, not in the repository.

Questions, and reporting a problem

• Security issues: security@fruxal.ca. A report is acknowledged within two business days.
• Privacy requests and Law 25 questions: privacy@fruxal.ca.
• A vendor security questionnaire can be sent to either address and is answered from this page. Where an answer here is no, the questionnaire gets the same no.

Last reviewed: 2026-09-13