Sovereignty is a promise that only means something if the trust surface is visible. This page collects the jurisdiction, certifications, sub-processors, and contacts that back the claims we make elsewhere on the site.
Breqwatr is incorporated in Canada, owned by Canadians, and operates exclusively under Canadian jurisdiction. No foreign parent, no foreign control plane, no US CLOUD Act exposure — court orders affecting customer data must originate in a Canadian court.
Workloads, backups, logs, and operational telemetry stay in Canadian regions. Because we run our own hardware and network, no third-party sub-processor touches your workload data, and it doesn't cross the border without your explicit, written instruction — in most cases, it can't.
| Framework | Status | Details |
|---|---|---|
| SOC 2 Type 2 | Valid | Covers security, availability, and confidentiality controls. Report available on request under NDA — ask via our contact form. |
| ISO 27001 | In progress | Our information security management system is being certified. The certificate will be published here once it's in hand. |
| CPCSC | In progress | Canadian Program for Cyber Security Certification — Canada's defence-supply-chain cyber framework, for defence and dual-use workloads. |
| PIPEDA | Aligned | Federal privacy alignment; provincial regimes (PHIPA, Law 25, FOIP) apply on top depending on workload. |
We welcome responsible disclosure from security researchers. The disclosure channel and policy live at /.well-known/security.txt in the RFC 9116 format. We acknowledge reports within one business day, keep you updated through remediation, and do not pursue researchers acting in good faith.
DPAs, audit packs, security questionnaires, sub-processor lists, and certification evidence: use our contact form and we'll route you.
Vulnerability reports: /.well-known/security.txt.
Live status: status.breqwatr.cloud.