Security & compliance

Access to client systems is requested in writing, restricted to the necessary scope and revoked at the end of the engagement. Multi-factor authentication is required wherever the platform allows it. No shared credentials are used.

• TLS-encrypted transport for all exchanges with the site and the firm's tools.
• Encryption at rest on the hosting environments used.
• Regular, verified backups with tested restoration.
• Strict separation of working environments by client.

A confidentiality agreement may be signed before any exchange of information. The firm publishes neither client names nor details of their operations without prior, specific written authorization.

The use of a supplier is governed by a written agreement providing for confidentiality, security and the return or destruction of data. Any disclosure outside Quebec is preceded by a privacy impact assessment, in accordance with Law 25.

• Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25.
• The Personal Information Protection and Electronic Documents Act, at the federal level.
• The General Data Protection Regulation, where individuals located in the European Economic Area are concerned.

A security incident triggers a documented procedure: containment, assessment of the risk of serious injury, notification of individuals and authorities where required, remediation and a written post-incident review.

Any vulnerability observed on this site may be reported to contact@kode-strategy.com. The firm acknowledges receipt, assesses the report and informs the reporter of the action taken. Intrusive testing without prior written authorization is not permitted.