Terms of Service
Quantoflow Data Privacy and Usage Document
Date: January 2, 2026
Data Security & Privacy
Data Storage & Security
All data is stored on a Cloud database located in Canada to ensure data sovereignty and compliance with Canadian regulations. The platform implements robust security measures including authentication protocols and client secrets to keep the database secure from unauthorized access.
Role-Based Access Control
The system employs different role-based access levels, ensuring that administrators have different rights and permissions compared to standard users within an organization. This ensures proper oversight and data governance.
Personal Identifiable Information (PII) Handling
Due to the regulatory nature of FINTRAC reporting, PII data may be present in the system, including sensitive identification information such as passport numbers or driver's license details. This information is collected and stored solely for the purpose of filing the required regulatory reports and is handled in accordance with applicable privacy and data protection requirements.
Data Breach Protocol
In the event of a data breach, you will be notified of their discovery. Our team will work closely with your organization to rectify the issue and implement necessary remediation measures to protect your data and maintain compliance.
Below is more details on data collection and how it is done. If additional security requirements are required, it is a conversation with Quantoflow's representatives.
Data Inventory & Third-Party Sharing
Based on the FINTRAC reporting requirements, here is how data is used in our system.
Transaction Data
| Field Name | Source | Purpose | Retention Period |
|---|---|---|---|
| Transaction ID | Customer CSV/Import | Unique identifier for regulatory reporting | 5 years (FINTRAC requirement) |
| Transaction Amount | Customer CSV/Import | Required for threshold reporting (LCTR, LVCTR, EFT) | 5 years |
| Transaction Date/Time | Customer CSV/Import | Regulatory compliance and audit trail | 5 years |
| Transaction Type | Customer CSV/Import | Classify report type (EFT, LCTR, LVCTR, STR) | 5 years |
| Currency Type and Exchange Rate | Customer CSV/Import | Required for FINTRAC schema | 5 years |
| Source of Funds | Customer CSV/Import | STR and due diligence requirements | 5 years |
Personal Identifiable Information (PII)
| Field Name | Source | Purpose | Retention Period |
|---|---|---|---|
| Full Name | Customer CSV/Import | Identity verification for FINTRAC reporting | 5 years |
| Government ID data (E.g. driver license, passport) | Customer CSV/Import | Required reporting field for ID verification. | 5 years |
| Address (Street, City, Province, Postal Code) | Customer CSV/Import | Required reporting field | 5 years |
| Phone Number | Customer CSV/Import | Contact information for reporting | 5 years |
| Email Address | Customer CSV/Import | Contact information for reporting | 5 years |
| Occupation | Customer CSV/Import | Risk assessment and STR filing | 5 years |
| Employer Name | Customer CSV/Import | Due diligence requirement | 5 years |
Note: The data is collected as text data. No images of the IDs are collected for the purpose of the report when filed on Quantoflow's system.
Account/Organization Data
| Field Name | Source | Purpose | Retention Period |
|---|---|---|---|
| Account Number | Customer CSV/Import | Link transactions to accounts | 5 years |
| Account Type | Customer CSV/Import | Classify account for reporting | 5 years |
| Organization Name | Customer CSV/Import | Business entity identification | 5 years |
| Organization Registration Number | Customer CSV/Import | Business entity verification | 5 years |
| Business Address | Customer CSV/Import | Entity verification | 5 years |
| Beneficial Owner Information | Customer CSV/Import | Required for entity reporting | 5 years |
Note: This is required for FINTRAC Report Filed
User Authentication & Platform Data
| Field Name | Source | Purpose | Retention Period | Third Parties |
|---|---|---|---|---|
| Username/Email | User Registration | Account access and authentication | Duration of account + 1 year | AWS |
| Password (hashed) | User Registration | Authentication security | Duration of account | AWS |
| Client Secrets/API Keys | System Generated | Database security and API access | Active until rotated | AWS |
| User Role (Admin/User) | Platform Assignment | Role-based access control | Duration of account + 1 year | AWS |
| Organization ID | Platform Assignment | Multi-tenant data segregation | Duration of account + 1 year | AWS |
| Login Timestamps | System Logs | Audit trail and security monitoring | 2 years | AWS, potentially CloudWatch |
| IP Address | System Logs | Security monitoring and fraud detection | 1 year | AWS, potentially CloudWatch |
| Session Tokens | System Generated | Active session management | Duration of session (24-48 hours) | AWS |
System Metadata & Operational Data
| Field Name | Source | Purpose | Retention Period | Third Parties |
|---|---|---|---|---|
| File Upload Metadata | User Upload | Track data imports and validation | 5 years | AWS S3 (if file storage used) |
| Report Submission Timestamp | System Generated | Audit trail for regulatory compliance | 5 years | AWS, FINTRAC |
| Report Status (Submitted/Corrected/Rejected) | System Generated | Track submission lifecycle | 7 years | AWS, FINTRAC |
| Data Mapping Configuration (Brevo, Odu columns) | User Configuration | Field mapping for FINTRAC schema | Duration of account + 1 year | AWS |
| Database Backup Copies | Automated Backup | Disaster recovery | 30-90 days (rolling) | AWS S3, AWS Backup |
Potential Blind Spots to Document
| Field Name | Source | Purpose | Retention Period | Third Parties |
|---|---|---|---|---|
| Analytics Events (if implemented) | User Interactions | Product improvement and usage tracking | 1-2 years | Potential: Google Analytics, Mixpanel, Amplitude |
| Customer Support Tickets | Support Tool | Customer service and issue resolution | 3 years | Potential: Intercom, Zendesk, Freshdesk |
| Error Monitoring Logs | Application Errors | Debugging and performance monitoring | 90 days | Potential: Sentry, Datadog, New Relic |
| Email Notifications | System Generated | User alerts and confirmations | 1 year | Potential: AWS SES |
| Slack Alerts (if implemented) | System Monitoring | Internal team notifications | 90 days | Slack |
| GitHub Actions Logs (if CI/CD) | Code Deployment | Development and deployment tracking | 90 days | GitHub |
| Application Performance Monitoring | System Monitoring | Performance optimization | 90 days | Potential: Datadog, New Relic |
Third-Party Data Processors - Complete List
Primary Infrastructure
Top Tier Cloud Platform Canada Region
- Purpose: Primary hosting, database storage (RDS/SQL), authentication services, API Services for providing report generation to FINTRAC format and submission process to FINTRAC API
- Data Shared: All data listed above
- Location: Canada
- Duration: Active account + retention period
Regulatory Reporting
FINTRAC (Financial Transactions and Reports Analysis Centre of Canada)
- Purpose: Regulatory compliance submissions
- Data Shared: All transaction and PII data required for EFT, LCTR, LVCTR, STR reports
- Location: Canada
- Duration: As per FINTRAC retention requirements (5+ years)
Potential Additional Third Parties (to verify and document)
Customer Support Tool (e.g., Slack)
- Purpose: Customer support ticket management
- Data Shared: Customer files, support communications, potentially PII
Email Service Provider (e.g., Amazon Web Service SES)
- Purpose: Emails and notifications
- Data Shared: User email addresses, notification content, data in aggregate
Error Monitoring
- Purpose: Application error tracking
- Data Shared: Error logs, potentially including request data
Code Repository (e.g., GitHub)
- Purpose: Source code management and CI/CD
- Data Shared: Deployment logs, potentially configuration data
Data Retention Policy Summary
Regulatory Data (Transaction & PII)
- Retention: 5 years from transaction date (FINTRAC requirement)
- After 5 years: Secure deletion from production databases
- Backup retention: Aligned with 5-year requirement
User Account Data
- Retention: Duration of active account + 1 year
- Upon account closure: 1-year retention for audit purposes, then secure deletion
System Logs & Monitoring
- Error logs: 2 years
- Performance monitoring: 90 days
- Security logs: 1-2 years
Database Backups
- Retention: 30-90 day rolling window
- Ensure: Backups don't create indefinite retention beyond policy
Support Communications
- Retention: 3 years from last interaction