Security and data
How we protect your data and your operations
When software runs part of your business, you should know who can reach the data, where it goes and how changes are made. Here is how we work, in plain language.
How we work
The practices behind every build
Collect less
We take only what the job needs. When we connect to a clinic's practice software, for example, we extract contact and appointment details and never pull patient charting.
Separate access
Our client portal signs people in with a code texted to their phone. Each person sees their own organization's tabs, and private reports stay out of search engines.
Test before release
Changes go to a private staging copy first, get checked there, and reach production only after that. Test records are deleted after testing.
Keep secrets out of code
Passwords and access keys stay out of our code repositories, and we have scanned the full history of those repositories for leaked keys.
Map the system
We keep a written map for each client of what was built, the services involved and how data moves between them, updated as the system changes.
Review as we change
We keep a running security audit. New changes are reviewed against it, and findings are recorded with their fixes.
An example
Built so even we can't read it
In Elephant Diary, a parenting record for separated parents, the password never leaves the person's device. Records are encrypted before they are sent, and the server stores only the encrypted version.
Not every project needs that level of protection. It shows that we match the design to the sensitivity of the data, and decide that at the start of a project.
What to ask us at the audit
- Which services will hold our data?
- Who at MoFluent can reach it?
- Can our data stay in Canada?
- What needs a person's approval?
- What happens if something fails?
Canadian privacy rules
We design with Canada's rules in mind: PIPEDA for personal information, Quebec's Law 25 where Quebec residents are involved, and CASL for commercial texts and emails. Our CASL guide shows the level of detail we work at.
Your organization stays responsible for its own compliance, and we aren't lawyers. If your project involves regulated data, tell us early, and bring your privacy officer or counsel into the audit. How this website handles information is covered in our privacy policy.
Questions
Frequently asked questions
Can our data be stored in Canada?
Tell us at the audit if this is a requirement. It affects which services we can use, so we settle it before the build, and we will say plainly if a particular tool can't meet it.
Do you hold a security certification?
We don't claim any certificate on this page. If your procurement process requires one or sends a security questionnaire, raise it early and we will answer it honestly.
Does AI get to act on its own?
Only where the risk is low and you have agreed to it. Decisions your team should make, such as refunds, complaints and anything a customer is upset about, stay with your people.
What do you do with test data?
We name test records so they can't be mistaken for real ones and delete them as soon as testing is finished.
Next step
Bring your hardest questions
If security or privacy is what has stopped you from building, start there. We would rather have that conversation first.